* [Qemu-devel] [PATCH] linux-user: return EINVAL on incorrect sockaddr
@ 2009-01-19 15:29 Riku Voipio
2009-01-30 19:51 ` Aurelien Jarno
0 siblings, 1 reply; 2+ messages in thread
From: Riku Voipio @ 2009-01-19 15:29 UTC (permalink / raw)
To: qemu-devel
From: Lauro Ramos Venancio <lauro.venancio@gmail.com>
Fixes ltp test accept01
Signed-off-by: Riku Voipio <riku.voipio@iki.fi>
---
linux-user/syscall.c | 33 +++++++++++++++++++++++++++++++--
1 files changed, 31 insertions(+), 2 deletions(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index ab81b3a..adb27de 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -1185,11 +1185,19 @@ static abi_long do_socket(int domain, int type, int protocol)
return get_errno(socket(domain, type, protocol));
}
+/* MAX_SOCK_ADDR from linux/net/socket.c */
+#define MAX_SOCK_ADDR 128
+
/* do_bind() Must return target values and target errnos. */
static abi_long do_bind(int sockfd, abi_ulong target_addr,
socklen_t addrlen)
{
- void *addr = alloca(addrlen);
+ void *addr;
+
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
+ addr = alloca(addrlen);
target_to_host_sockaddr(addr, target_addr, addrlen);
return get_errno(bind(sockfd, addr, addrlen));
@@ -1199,7 +1207,12 @@ static abi_long do_bind(int sockfd, abi_ulong target_addr,
static abi_long do_connect(int sockfd, abi_ulong target_addr,
socklen_t addrlen)
{
- void *addr = alloca(addrlen);
+ void *addr;
+
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
+ addr = alloca(addrlen);
target_to_host_sockaddr(addr, target_addr, addrlen);
return get_errno(connect(sockfd, addr, addrlen));
@@ -1271,6 +1284,9 @@ static abi_long do_accept(int fd, abi_ulong target_addr,
if (get_user_u32(addrlen, target_addrlen_addr))
return -TARGET_EFAULT;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
addr = alloca(addrlen);
ret = get_errno(accept(fd, addr, &addrlen));
@@ -1293,6 +1309,9 @@ static abi_long do_getpeername(int fd, abi_ulong target_addr,
if (get_user_u32(addrlen, target_addrlen_addr))
return -TARGET_EFAULT;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
addr = alloca(addrlen);
ret = get_errno(getpeername(fd, addr, &addrlen));
@@ -1315,6 +1334,9 @@ static abi_long do_getsockname(int fd, abi_ulong target_addr,
if (get_user_u32(addrlen, target_addrlen_addr))
return -TARGET_EFAULT;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
addr = alloca(addrlen);
ret = get_errno(getsockname(fd, addr, &addrlen));
@@ -1350,6 +1372,9 @@ static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
void *host_msg;
abi_long ret;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
host_msg = lock_user(VERIFY_READ, msg, len, 1);
if (!host_msg)
return -TARGET_EFAULT;
@@ -1382,6 +1407,10 @@ static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
ret = -TARGET_EFAULT;
goto fail;
}
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) {
+ ret = -TARGET_EINVAL;
+ goto fail;
+ }
addr = alloca(addrlen);
ret = get_errno(recvfrom(fd, host_msg, len, flags, addr, &addrlen));
} else {
--
1.5.6.5
--
"rm -rf" only sounds scary if you don't have backups
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Qemu-devel] [PATCH] linux-user: return EINVAL on incorrect sockaddr
2009-01-19 15:29 [Qemu-devel] [PATCH] linux-user: return EINVAL on incorrect sockaddr Riku Voipio
@ 2009-01-30 19:51 ` Aurelien Jarno
0 siblings, 0 replies; 2+ messages in thread
From: Aurelien Jarno @ 2009-01-30 19:51 UTC (permalink / raw)
To: Riku Voipio; +Cc: qemu-devel
On Mon, Jan 19, 2009 at 05:29:52PM +0200, Riku Voipio wrote:
> From: Lauro Ramos Venancio <lauro.venancio@gmail.com>
>
> Fixes ltp test accept01
>
> Signed-off-by: Riku Voipio <riku.voipio@iki.fi>
Thanks, applied.
> ---
> linux-user/syscall.c | 33 +++++++++++++++++++++++++++++++--
> 1 files changed, 31 insertions(+), 2 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index ab81b3a..adb27de 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -1185,11 +1185,19 @@ static abi_long do_socket(int domain, int type, int protocol)
> return get_errno(socket(domain, type, protocol));
> }
>
> +/* MAX_SOCK_ADDR from linux/net/socket.c */
> +#define MAX_SOCK_ADDR 128
> +
> /* do_bind() Must return target values and target errnos. */
> static abi_long do_bind(int sockfd, abi_ulong target_addr,
> socklen_t addrlen)
> {
> - void *addr = alloca(addrlen);
> + void *addr;
> +
> + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
> + return -TARGET_EINVAL;
> +
> + addr = alloca(addrlen);
>
> target_to_host_sockaddr(addr, target_addr, addrlen);
> return get_errno(bind(sockfd, addr, addrlen));
> @@ -1199,7 +1207,12 @@ static abi_long do_bind(int sockfd, abi_ulong target_addr,
> static abi_long do_connect(int sockfd, abi_ulong target_addr,
> socklen_t addrlen)
> {
> - void *addr = alloca(addrlen);
> + void *addr;
> +
> + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
> + return -TARGET_EINVAL;
> +
> + addr = alloca(addrlen);
>
> target_to_host_sockaddr(addr, target_addr, addrlen);
> return get_errno(connect(sockfd, addr, addrlen));
> @@ -1271,6 +1284,9 @@ static abi_long do_accept(int fd, abi_ulong target_addr,
> if (get_user_u32(addrlen, target_addrlen_addr))
> return -TARGET_EFAULT;
>
> + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
> + return -TARGET_EINVAL;
> +
> addr = alloca(addrlen);
>
> ret = get_errno(accept(fd, addr, &addrlen));
> @@ -1293,6 +1309,9 @@ static abi_long do_getpeername(int fd, abi_ulong target_addr,
> if (get_user_u32(addrlen, target_addrlen_addr))
> return -TARGET_EFAULT;
>
> + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
> + return -TARGET_EINVAL;
> +
> addr = alloca(addrlen);
>
> ret = get_errno(getpeername(fd, addr, &addrlen));
> @@ -1315,6 +1334,9 @@ static abi_long do_getsockname(int fd, abi_ulong target_addr,
> if (get_user_u32(addrlen, target_addrlen_addr))
> return -TARGET_EFAULT;
>
> + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
> + return -TARGET_EINVAL;
> +
> addr = alloca(addrlen);
>
> ret = get_errno(getsockname(fd, addr, &addrlen));
> @@ -1350,6 +1372,9 @@ static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
> void *host_msg;
> abi_long ret;
>
> + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
> + return -TARGET_EINVAL;
> +
> host_msg = lock_user(VERIFY_READ, msg, len, 1);
> if (!host_msg)
> return -TARGET_EFAULT;
> @@ -1382,6 +1407,10 @@ static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
> ret = -TARGET_EFAULT;
> goto fail;
> }
> + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) {
> + ret = -TARGET_EINVAL;
> + goto fail;
> + }
> addr = alloca(addrlen);
> ret = get_errno(recvfrom(fd, host_msg, len, flags, addr, &addrlen));
> } else {
> --
> 1.5.6.5
>
>
> --
> "rm -rf" only sounds scary if you don't have backups
>
>
>
--
Aurelien Jarno GPG: 1024D/F1BCDB73
aurelien@aurel32.net http://www.aurel32.net
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-01-30 19:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-01-19 15:29 [Qemu-devel] [PATCH] linux-user: return EINVAL on incorrect sockaddr Riku Voipio
2009-01-30 19:51 ` Aurelien Jarno
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).