From: Aurelien Jarno <aurelien@aurel32.net>
To: qemu-devel@nongnu.org
Subject: [Qemu-devel] [6479] linux-user: return EINVAL on incorrect sockaddr
Date: Fri, 30 Jan 2009 19:47:58 +0000 [thread overview]
Message-ID: <E1LSzLJ-0003S8-WE@cvs.savannah.gnu.org> (raw)
Revision: 6479
http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=6479
Author: aurel32
Date: 2009-01-30 19:47:57 +0000 (Fri, 30 Jan 2009)
Log Message:
-----------
linux-user: return EINVAL on incorrect sockaddr
From: Lauro Ramos Venancio <lauro.venancio@gmail.com>
Fixes ltp test accept01
Signed-off-by: Riku Voipio <riku.voipio@iki.fi>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Modified Paths:
--------------
trunk/linux-user/syscall.c
Modified: trunk/linux-user/syscall.c
===================================================================
--- trunk/linux-user/syscall.c 2009-01-30 19:47:47 UTC (rev 6478)
+++ trunk/linux-user/syscall.c 2009-01-30 19:47:57 UTC (rev 6479)
@@ -1140,12 +1140,20 @@
return get_errno(socket(domain, type, protocol));
}
+/* MAX_SOCK_ADDR from linux/net/socket.c */
+#define MAX_SOCK_ADDR 128
+
/* do_bind() Must return target values and target errnos. */
static abi_long do_bind(int sockfd, abi_ulong target_addr,
socklen_t addrlen)
{
- void *addr = alloca(addrlen);
+ void *addr;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
+ addr = alloca(addrlen);
+
target_to_host_sockaddr(addr, target_addr, addrlen);
return get_errno(bind(sockfd, addr, addrlen));
}
@@ -1154,8 +1162,13 @@
static abi_long do_connect(int sockfd, abi_ulong target_addr,
socklen_t addrlen)
{
- void *addr = alloca(addrlen);
+ void *addr;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
+ addr = alloca(addrlen);
+
target_to_host_sockaddr(addr, target_addr, addrlen);
return get_errno(connect(sockfd, addr, addrlen));
}
@@ -1226,6 +1239,9 @@
if (get_user_u32(addrlen, target_addrlen_addr))
return -TARGET_EFAULT;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
addr = alloca(addrlen);
ret = get_errno(accept(fd, addr, &addrlen));
@@ -1248,6 +1264,9 @@
if (get_user_u32(addrlen, target_addrlen_addr))
return -TARGET_EFAULT;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
addr = alloca(addrlen);
ret = get_errno(getpeername(fd, addr, &addrlen));
@@ -1273,6 +1292,9 @@
if (get_user_u32(addrlen, target_addrlen_addr))
return -TARGET_EFAULT;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
addr = alloca(addrlen);
ret = get_errno(getsockname(fd, addr, &addrlen));
@@ -1308,6 +1330,9 @@
void *host_msg;
abi_long ret;
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR)
+ return -TARGET_EINVAL;
+
host_msg = lock_user(VERIFY_READ, msg, len, 1);
if (!host_msg)
return -TARGET_EFAULT;
@@ -1340,6 +1365,10 @@
ret = -TARGET_EFAULT;
goto fail;
}
+ if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) {
+ ret = -TARGET_EINVAL;
+ goto fail;
+ }
addr = alloca(addrlen);
ret = get_errno(recvfrom(fd, host_msg, len, flags, addr, &addrlen));
} else {
reply other threads:[~2009-01-30 19:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E1LSzLJ-0003S8-WE@cvs.savannah.gnu.org \
--to=aurelien@aurel32.net \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).