From 8644187dad7b54af091a9162382bb0b561d53fbc Mon Sep 17 00:00:00 2001 From: martin Date: Wed, 3 Aug 2022 11:05:51 +0000 Subject: Pull up following revision(s), all via patch (requested by riastradh in ticket #1489): sys/compat/netbsd32/netbsd32_netbsd.c: revision 1.232 sys/compat/netbsd32/netbsd32_socket.c: revision 1.56 sys/compat/netbsd32/netbsd32_conv.h: revision 1.45 sys/compat/netbsd32/netbsd32_fs.c: revision 1.92 sys/compat/netbsd32/netbsd32.h: revision 1.137 The read/write/send/recv system calls return ssize_t because -1 is returned on error. Therefore we must restrict the lengths of any buffers to NETBSD32_SSIZE_MAX with compat32 to avoid garbage return values. Fixes ATF lib/libc/sys/t_write:write_err. --- sys/compat/netbsd32/netbsd32_socket.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'sys/compat/netbsd32/netbsd32_socket.c') diff --git a/sys/compat/netbsd32/netbsd32_socket.c b/sys/compat/netbsd32/netbsd32_socket.c index 6bb472a45e1..cae27646a1d 100644 --- a/sys/compat/netbsd32/netbsd32_socket.c +++ b/sys/compat/netbsd32/netbsd32_socket.c @@ -1,4 +1,4 @@ -/* $NetBSD: netbsd32_socket.c,v 1.49 2018/11/14 17:51:37 hannken Exp $ */ +/* $NetBSD: netbsd32_socket.c,v 1.49.4.1 2022/08/03 11:05:51 martin Exp $ */ /* * Copyright (c) 1998, 2001 Matthew R. Green @@ -27,7 +27,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.49 2018/11/14 17:51:37 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.49.4.1 2022/08/03 11:05:51 martin Exp $"); #include #include @@ -635,6 +635,9 @@ netbsd32_recvfrom(struct lwp *l, const struct netbsd32_recvfrom_args *uap, int error; struct mbuf *from; + if (SCARG(uap, len) > NETBSD32_SSIZE_MAX) + return EINVAL; + msg.msg_name = NULL; msg.msg_iov = &aiov; msg.msg_iovlen = 1; @@ -669,6 +672,9 @@ netbsd32_sendto(struct lwp *l, const struct netbsd32_sendto_args *uap, struct msghdr msg; struct iovec aiov; + if (SCARG(uap, len) > NETBSD32_SSIZE_MAX) + return EINVAL; + msg.msg_name = SCARG_P32(uap, to); /* XXX kills const */ msg.msg_namelen = SCARG(uap, tolen); msg.msg_iov = &aiov; -- cgit