Attachment 199382 Details for Bug 217901 – linux.sendmsg.2.patch

[patch] linux.sendmsg.2.patch

linux.sendmsg.2.patch (text/plain), 1.94 KB, created by Tijl Coosemans on 2018-11-20 14:29:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tijl Coosemans

Created: 2018-11-20 14:29:45 UTC

Size: 1.94 KB

patch

obsolete

>Index: sys/compat/linux/linux_socket.c
>==============================================================================
>--- sys/compat/linux/linux_socket.c	Tue Nov 20 11:23:33 2018	(r340673)
>+++ sys/compat/linux/linux_socket.c	Tue Nov 20 14:18:57 2018	(working copy)
>@@ -1096,6 +1096,7 @@ linux_sendmsg_common(struct thread *td, l_int s, struc
> 	sa_family_t sa_family;
> 	void *data;
> 	l_size_t len;
>+	l_size_t clen;
> 	int error;
> 
> 	error = copyin(msghdr, &linux_msg, sizeof(linux_msg));
>@@ -1127,7 +1128,7 @@ linux_sendmsg_common(struct thread *td, l_int s, struc
> 
> 	control = NULL;
> 
>-	if ((ptr_cmsg = LINUX_CMSG_FIRSTHDR(&linux_msg)) != NULL) {
>+	if (linux_msg.msg_controllen >= sizeof(struct l_cmsghdr)) {
> 		error = kern_getsockname(td, s, &sa, &datalen);
> 		if (error != 0)
> 			goto bad;
>@@ -1140,6 +1141,8 @@ linux_sendmsg_common(struct thread *td, l_int s, struc
> 		data = mtod(control, void *);
> 		datalen = 0;
> 
>+		ptr_cmsg = PTRIN(linux_msg.msg_control);
>+		clen = linux_msg.msg_controllen;
> 		do {
> 			error = copyin(ptr_cmsg, &linux_cmsg,
> 			    sizeof(struct l_cmsghdr));
>@@ -1147,7 +1150,8 @@ linux_sendmsg_common(struct thread *td, l_int s, struc
> 				goto bad;
> 
> 			error = EINVAL;
>-			if (linux_cmsg.cmsg_len < sizeof(struct l_cmsghdr))
>+			if (linux_cmsg.cmsg_len < sizeof(struct l_cmsghdr) ||
>+			    linux_cmsg.cmsg_len > clen)
> 				goto bad;
> 
> 			if (datalen + CMSG_HDRSZ > MCLBYTES)
>@@ -1199,7 +1203,14 @@ linux_sendmsg_common(struct thread *td, l_int s, struc
> 			cmsg->cmsg_len = CMSG_LEN(len);
> 			data = (char *)data + CMSG_SPACE(len);
> 			datalen += CMSG_SPACE(len);
>-		} while ((ptr_cmsg = LINUX_CMSG_NXTHDR(&linux_msg, ptr_cmsg)));
>+
>+			if (clen <= LINUX_CMSG_ALIGN(linux_cmsg.cmsg_len))
>+				break;
>+
>+			clen -= LINUX_CMSG_ALIGN(linux_cmsg.cmsg_len);
>+			ptr_cmsg = (struct l_cmsghdr *)((char *)ptr_cmsg +
>+			    LINUX_CMSG_ALIGN(linux_cmsg.cmsg_len));
>+		} while(clen >= sizeof(struct l_cmsghdr));
> 
> 		control->m_len = datalen;
> 		if (datalen == 0) {

Actions: View | Diff

Attachments on bug 217901: 199099 | 199205 | 199213 | 199218 | 199220 | 199335 | 199336 | 199359 | 199360 | 199382 | 199451