Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use consistent types for len. Limit sockarg length to reasonable values.

Browse Source
This commit is contained in:
matt 2001-07-01 20:42:48 +00:00
parent 5bdb21d48a
commit 54ec2573c9
2 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
sys/kern/uipc_syscalls.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: uipc_syscalls.c,v 1.63 2001/06/25 20:46:13 jdolecek Exp $ */
/* $NetBSD: uipc_syscalls.c,v 1.64 2001/07/01 20:42:48 matt Exp $ */
/*
* Copyright (c) 1982, 1986, 1989, 1990, 1993
@ -1068,7 +1068,7 @@ sys_getpeername(struct proc *p, void *v, register_t *retval)
* XXX arguments in mbufs, and this could go away.
*/
int
sockargs(struct mbuf **mp, const void *buf, int buflen, int type)
sockargs(struct mbuf **mp, const void *buf, size_t buflen, int type)
{
struct sockaddr *sa;
struct mbuf *m;
@ -1076,14 +1076,15 @@ sockargs(struct mbuf **mp, const void *buf, int buflen, int type)
/*
* We can't allow socket names > UCHAR_MAX in length, since that
* will overflow sa_len.
* will overflow sa_len. Control data more than a page size in
* length is just too much.
*/
if (type == MT_SONAME && (u_int)buflen > UCHAR_MAX)
if (buflen > (type == MT_SONAME ? UCHAR_MAX : PAGE_SIZE))
return (EINVAL);
/* Allocate an mbuf to hold the arguments. */
m = m_get(M_WAIT, type);
if ((u_int)buflen > MLEN) {
if (buflen > MLEN) {
/*
* Won't fit into a regular mbuf, so we allocate just
* enough external storage to hold the argument.
@ -1091,7 +1092,7 @@ sockargs(struct mbuf **mp, const void *buf, int buflen, int type)
MEXTMALLOC(m, buflen, M_WAITOK);
}
m->m_len = buflen;
error = copyin(buf, mtod(m, caddr_t), (u_int)buflen);
error = copyin(buf, mtod(m, caddr_t), buflen);
if (error) {
(void) m_free(m);
return (error);

4
sys/sys/socketvar.h
View File

@ -1,4 +1,4 @@
/* $NetBSD: socketvar.h,v 1.48 2001/06/25 20:46:12 jdolecek Exp $ */
/* $NetBSD: socketvar.h,v 1.49 2001/07/01 20:42:48 matt Exp $ */
/*-
* Copyright (c) 1982, 1986, 1990, 1993
@ -315,7 +315,7 @@ int sosend(struct socket *so, struct mbuf *addr, struct uio *uio,
int sosetopt(struct socket *so, int level, int optname, struct mbuf *m0);
int soshutdown(struct socket *so, int how);
void sowakeup(struct socket *so, struct sockbuf *sb);
int sockargs(struct mbuf **, const void *, int, int);
int sockargs(struct mbuf **, const void *, size_t, int);
int sendit(struct proc *, int, struct msghdr *, int, register_t *);
int recvit(struct proc *, int, struct msghdr *, caddr_t, register_t *);