summaryrefslogtreecommitdiff
path: root/sys/compat/netbsd32/netbsd32_socket.c
diff options
context:
space:
mode:
authormartin <martin@NetBSD.org>2022-08-03 11:05:51 +0000
committermartin <martin@NetBSD.org>2022-08-03 11:05:51 +0000
commit8644187dad7b54af091a9162382bb0b561d53fbc (patch)
tree7824b9316c32c8a81784ba35c21556b1de23b735 /sys/compat/netbsd32/netbsd32_socket.c
parent6fe4a01f01d3fb44a5a91090b4d150a3bd1b326a (diff)
Pull up following revision(s), all via patch
(requested by riastradh in ticket #1489): sys/compat/netbsd32/netbsd32_netbsd.c: revision 1.232 sys/compat/netbsd32/netbsd32_socket.c: revision 1.56 sys/compat/netbsd32/netbsd32_conv.h: revision 1.45 sys/compat/netbsd32/netbsd32_fs.c: revision 1.92 sys/compat/netbsd32/netbsd32.h: revision 1.137 The read/write/send/recv system calls return ssize_t because -1 is returned on error. Therefore we must restrict the lengths of any buffers to NETBSD32_SSIZE_MAX with compat32 to avoid garbage return values. Fixes ATF lib/libc/sys/t_write:write_err.
Diffstat (limited to 'sys/compat/netbsd32/netbsd32_socket.c')
-rw-r--r--sys/compat/netbsd32/netbsd32_socket.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/sys/compat/netbsd32/netbsd32_socket.c b/sys/compat/netbsd32/netbsd32_socket.c
index 6bb472a45e1..cae27646a1d 100644
--- a/sys/compat/netbsd32/netbsd32_socket.c
+++ b/sys/compat/netbsd32/netbsd32_socket.c
@@ -1,4 +1,4 @@
-/* $NetBSD: netbsd32_socket.c,v 1.49 2018/11/14 17:51:37 hannken Exp $ */
+/* $NetBSD: netbsd32_socket.c,v 1.49.4.1 2022/08/03 11:05:51 martin Exp $ */
/*
* Copyright (c) 1998, 2001 Matthew R. Green
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.49 2018/11/14 17:51:37 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.49.4.1 2022/08/03 11:05:51 martin Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -635,6 +635,9 @@ netbsd32_recvfrom(struct lwp *l, const struct netbsd32_recvfrom_args *uap,
int error;
struct mbuf *from;
+ if (SCARG(uap, len) > NETBSD32_SSIZE_MAX)
+ return EINVAL;
+
msg.msg_name = NULL;
msg.msg_iov = &aiov;
msg.msg_iovlen = 1;
@@ -669,6 +672,9 @@ netbsd32_sendto(struct lwp *l, const struct netbsd32_sendto_args *uap,
struct msghdr msg;
struct iovec aiov;
+ if (SCARG(uap, len) > NETBSD32_SSIZE_MAX)
+ return EINVAL;
+
msg.msg_name = SCARG_P32(uap, to); /* XXX kills const */
msg.msg_namelen = SCARG(uap, tolen);
msg.msg_iov = &aiov;