* sysdeps/gnu/bits/msq.h: Qualify kernel's

data structure pointers as __unbounded. 
* sysdeps/unix/sysv/linux/mips/bits/shm.h: Likewise. 
* sysdeps/generic/bp-semctl.h: New file. 
* sysdeps/unix/sysv/linux/msgctl.c: Qualify kernel's data structure 
pointers as __unbounded.  Check bounds of syscall args. 
* sysdeps/unix/sysv/linux/msgrcv.c: Likewise. 
* sysdeps/unix/sysv/linux/msgsnd.c: Likewise. 
* sysdeps/unix/sysv/linux/semctl.c: Likewise. 
* sysdeps/unix/sysv/linux/semop.c: Likewise. 
* sysdeps/unix/sysv/linux/shmat.c: Likewise. 
* sysdeps/unix/sysv/linux/shmctl.c: Likewise. 
* sysdeps/unix/sysv/linux/shmdt.c: Likewise. 
* sysdeps/unix/sysv/linux/alpha/msgctl.c: Likewise. 
* sysdeps/unix/sysv/linux/alpha/semctl.c: Likewise. 
* sysdeps/unix/sysv/linux/alpha/shmctl.c: Likewise. 
* sysdeps/unix/sysv/linux/i386/msgctl.c: Likewise. 
* sysdeps/unix/sysv/linux/i386/semctl.c: Likewise. 
* sysdeps/unix/sysv/linux/i386/shmctl.c: Likewise. 
* sysdeps/unix/sysv/linux/sparc/sparc64/msgctl.c: Likewise. 
* sysdeps/unix/sysv/linux/sparc/sparc64/semctl.c: Likewise. 
* sysdeps/unix/sysv/linux/sparc/sparc64/shmctl.c: Likewise.
2000-07-26  Greg McGary  <greg@mcgary.org>

	* sysdeps/gnu/bits/msq.h: Qualify kernel's
	data structure pointers as __unbounded.
	* sysdeps/unix/sysv/linux/mips/bits/shm.h: Likewise.
	* sysdeps/generic/bp-semctl.h: New file.
	* sysdeps/unix/sysv/linux/msgctl.c: Qualify kernel's data structure
	pointers as __unbounded.  Check bounds of syscall args.
	* sysdeps/unix/sysv/linux/msgrcv.c: Likewise.
	* sysdeps/unix/sysv/linux/msgsnd.c: Likewise.
	* sysdeps/unix/sysv/linux/semctl.c: Likewise.
	* sysdeps/unix/sysv/linux/semop.c: Likewise.
	* sysdeps/unix/sysv/linux/shmat.c: Likewise.
	* sysdeps/unix/sysv/linux/shmctl.c: Likewise.
	* sysdeps/unix/sysv/linux/shmdt.c: Likewise.
	* sysdeps/unix/sysv/linux/alpha/msgctl.c: Likewise.
	* sysdeps/unix/sysv/linux/alpha/semctl.c: Likewise.
	* sysdeps/unix/sysv/linux/alpha/shmctl.c: Likewise.
	* sysdeps/unix/sysv/linux/i386/msgctl.c: Likewise.
	* sysdeps/unix/sysv/linux/i386/semctl.c: Likewise.
	* sysdeps/unix/sysv/linux/i386/shmctl.c: Likewise.
	* sysdeps/unix/sysv/linux/sparc/sparc64/msgctl.c: Likewise.
	* sysdeps/unix/sysv/linux/sparc/sparc64/semctl.c: Likewise.
	* sysdeps/unix/sysv/linux/sparc/sparc64/shmctl.c: Likewise.

1 files changed, 13 insertions, 8 deletions

diff --git a/sysdeps/unix/sysv/linux/i386/shmctl.c b/sysdeps/unix/sysv/linux/i386/shmctl.c
index ca25ff0c7a..402fb46717 100644
--- a/sysdeps/unix/sysv/linux/i386/shmctl.c
+++ b/sysdeps/unix/sysv/linux/i386/shmctl.c
@@ -25,6 +25,7 @@
 #include <string.h>
 #include <sys/syscall.h>
 #include <bits/wordsize.h>
+#include <bp-checks.h>
 
 #include "kernel-features.h"
 #include <shlib-compat.h>
@@ -40,8 +41,8 @@ struct __old_shmid_ds
   __ipc_pid_t shm_lpid;			/* pid of last shmop */
   unsigned short int shm_nattch;	/* number of current attaches */
   unsigned short int __shm_npages;	/* size of segment (pages) */
-  unsigned long int *__shm_pages;	/* array of ptrs to frames -> SHMMAX */
-  struct vm_area_struct *__attaches;	/* descriptors for attaches */
+  unsigned long int *__unbounded __shm_pages; /* array of ptrs to frames -> SHMMAX */
+  struct vm_area_struct *__unbounded __attaches; /* descriptors for attaches */
 };
 
 struct __old_shminfo
@@ -71,7 +72,8 @@ int __new_shmctl (int, int, struct shmid_ds *);
 int
 __old_shmctl (int shmid, int cmd, struct __old_shmid_ds *buf)
 {
-  return INLINE_SYSCALL (ipc, 5, IPCOP_shmctl, shmid, cmd, 0, buf);
+  return INLINE_SYSCALL (ipc, 5, IPCOP_shmctl,
+			 shmid, cmd, 0, CHECK_1 (buf));
 }
 compat_symbol (libc, __old_shmctl, shmctl, GLIBC_2_0);
 #endif
@@ -80,7 +82,8 @@ int
 __new_shmctl (int shmid, int cmd, struct shmid_ds *buf)
 {
 #if __ASSUME_32BITUIDS > 0
-  return INLINE_SYSCALL (ipc, 5, IPCOP_shmctl, shmid, cmd | __IPC_64, 0, buf);
+  return INLINE_SYSCALL (ipc, 5, IPCOP_shmctl,
+			 shmid, cmd | __IPC_64, 0, CHECK_1 (buf));
 #else
   switch (cmd) {
     case SHM_STAT:
@@ -91,7 +94,8 @@ __new_shmctl (int shmid, int cmd, struct shmid_ds *buf)
 # endif
       break;
     default:
-      return INLINE_SYSCALL (ipc, 5, IPCOP_shmctl, shmid, cmd, 0, buf);
+      return INLINE_SYSCALL (ipc, 5, IPCOP_shmctl,
+			     shmid, cmd, 0, CHECK_1 (buf));
   }
 
   {
@@ -114,8 +118,8 @@ __new_shmctl (int shmid, int cmd, struct shmid_ds *buf)
 	    __set_errno(save_errno);
 	  }
 	if (__libc_missing_32bit_uids <= 0)
-	  return INLINE_SYSCALL (ipc, 5, IPCOP_shmctl, shmid, cmd | __IPC_64,
-				 0, buf);
+	  return INLINE_SYSCALL (ipc, 5, IPCOP_shmctl,
+				 shmid, cmd | __IPC_64, 0, CHECK_1 (buf));
       }
 # endif
 
@@ -131,7 +135,8 @@ __new_shmctl (int shmid, int cmd, struct shmid_ds *buf)
 	    return -1;
 	  }
       }
-    result = INLINE_SYSCALL (ipc, 5, IPCOP_shmctl, shmid, cmd, 0, &old);
+    result = INLINE_SYSCALL (ipc, 5, IPCOP_shmctl,
+			     shmid, cmd, 0, __ptrvalue (&old));
     if (result != -1 && (cmd == SHM_STAT || cmd == IPC_STAT))
       {
 	memset(buf, 0, sizeof(*buf));