d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Check lower bound of cmsg_len.

Browse Source 
If passed cm->cmsg_len was below cmsghdr size the experssion:
datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;

would give negative result. However, in practice it would not
result in a crash because the kernel would try to obtain garbage fds
for given process and would error out with EBADF.

PR:		124908
Submitted by:	campbell mumble.net (modified a little)
MFC after:	1 week
This commit is contained in:
mjg 2014-06-27 05:04:36 +00:00
parent da67e0c76e
commit 21b16efdd1
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/kern/uipc_usrreq.c
View File

@ -1859,7 +1859,7 @@ unp_internalize(struct mbuf **controlp, struct thread *td)
*controlp = NULL; *controlp = NULL;
while (cm != NULL) { while (cm != NULL) {
if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET
|| cm->cmsg_len > clen) { || cm->cmsg_len > clen || cm->cmsg_len < sizeof(*cm)) {
error = EINVAL; error = EINVAL;
goto out; goto out;
} }