diff options
| author | martin <martin@NetBSD.org> | 2022-08-03 11:05:51 +0000 |
|---|---|---|
| committer | martin <martin@NetBSD.org> | 2022-08-03 11:05:51 +0000 |
| commit | 8644187dad7b54af091a9162382bb0b561d53fbc (patch) | |
| tree | 7824b9316c32c8a81784ba35c21556b1de23b735 /sys/compat/netbsd32/netbsd32_socket.c | |
| parent | 6fe4a01f01d3fb44a5a91090b4d150a3bd1b326a (diff) | |
Pull up following revision(s), all via patch
(requested by riastradh in ticket #1489):
sys/compat/netbsd32/netbsd32_netbsd.c: revision 1.232
sys/compat/netbsd32/netbsd32_socket.c: revision 1.56
sys/compat/netbsd32/netbsd32_conv.h: revision 1.45
sys/compat/netbsd32/netbsd32_fs.c: revision 1.92
sys/compat/netbsd32/netbsd32.h: revision 1.137
The read/write/send/recv system calls return ssize_t because -1 is
returned on error. Therefore we must restrict the lengths of any
buffers to NETBSD32_SSIZE_MAX with compat32 to avoid garbage return
values.
Fixes ATF lib/libc/sys/t_write:write_err.
Diffstat (limited to 'sys/compat/netbsd32/netbsd32_socket.c')
| -rw-r--r-- | sys/compat/netbsd32/netbsd32_socket.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/sys/compat/netbsd32/netbsd32_socket.c b/sys/compat/netbsd32/netbsd32_socket.c index 6bb472a45e1..cae27646a1d 100644 --- a/sys/compat/netbsd32/netbsd32_socket.c +++ b/sys/compat/netbsd32/netbsd32_socket.c @@ -1,4 +1,4 @@ -/* $NetBSD: netbsd32_socket.c,v 1.49 2018/11/14 17:51:37 hannken Exp $ */ +/* $NetBSD: netbsd32_socket.c,v 1.49.4.1 2022/08/03 11:05:51 martin Exp $ */ /* * Copyright (c) 1998, 2001 Matthew R. Green @@ -27,7 +27,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.49 2018/11/14 17:51:37 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.49.4.1 2022/08/03 11:05:51 martin Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -635,6 +635,9 @@ netbsd32_recvfrom(struct lwp *l, const struct netbsd32_recvfrom_args *uap, int error; struct mbuf *from; + if (SCARG(uap, len) > NETBSD32_SSIZE_MAX) + return EINVAL; + msg.msg_name = NULL; msg.msg_iov = &aiov; msg.msg_iovlen = 1; @@ -669,6 +672,9 @@ netbsd32_sendto(struct lwp *l, const struct netbsd32_sendto_args *uap, struct msghdr msg; struct iovec aiov; + if (SCARG(uap, len) > NETBSD32_SSIZE_MAX) + return EINVAL; + msg.msg_name = SCARG_P32(uap, to); /* XXX kills const */ msg.msg_namelen = SCARG(uap, tolen); msg.msg_iov = &aiov; |
