From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37241) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bDcYD-0002cw-O9 for qemu-devel@nongnu.org; Thu, 16 Jun 2016 15:02:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bDcY6-0006iD-IM for qemu-devel@nongnu.org; Thu, 16 Jun 2016 15:02:00 -0400 Received: from mout.kundenserver.de ([212.227.126.131]:65398) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bDcY6-0006i7-7C for qemu-devel@nongnu.org; Thu, 16 Jun 2016 15:01:54 -0400 From: Laurent Vivier Date: Thu, 16 Jun 2016 21:01:36 +0200 Message-Id: <1466103697-27279-2-git-send-email-laurent@vivier.eu> In-Reply-To: <1466103697-27279-1-git-send-email-laurent@vivier.eu> References: <1466103697-27279-1-git-send-email-laurent@vivier.eu> Subject: [Qemu-devel] [PATCH 1/2] linux-user: fd_trans_host_to_target_data() must process only received data List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Riku Voipio Cc: qemu-devel@nongnu.org, Laurent Vivier if we process the whole buffer, the netlink helpers can try to swap invalid data. Signed-off-by: Laurent Vivier --- linux-user/syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 0b937ca..3c30437 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -2987,7 +2987,7 @@ static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp, len = ret; if (fd_trans_host_to_target_data(fd)) { ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base, - msg.msg_iov->iov_len); + len); } else { ret = host_to_target_cmsg(msgp, &msg); } -- 2.5.5