illumos gate

The code for loading the event map in "libbsm" has at least two serious bugs.

1.) There is a buffer overflow in the load_map() function in "usr/src/lib/libbsm/common/au_preselect.c":

static int
load_map()
{
        register au_event_ent_t *evp;

        event_count = 0;
        setauevent();
        while ((evp = getauevent()) != (au_event_ent_t *)NULL) {
                if (event_count > alloc_count)    <========
                        if (realloc_map() == -1) {
                                endauevent();
                                return (-1);
                        }
                event_map[event_count].event = evp->ae_number;
                event_map[event_count].class = evp->ae_class;
                ++event_count;
        }
        endauevent();

        return (0);
}

It tries to store one more element in the allocated buffer that there is room for.

2.) The code for resizing the map will leak memory if the resize fails and lead to later crashes:

static int
realloc_map()
{
        register size_t rsize;
        rsize = sizeof (event_map_t) * (alloc_count + ALLOC_INCR);

        if ((event_map = (event_map_t *)
            realloc(event_map, rsize)) == (event_map_t *)NULL)
                return (-1);

        return (0);
}

Calling the function reallocf() here would IMHO not be the correct solution as we want to keep the old map.