From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LSzLN-0006mU-LO for qemu-devel@nongnu.org; Fri, 30 Jan 2009 14:48:01 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LSzLM-0006lM-2U for qemu-devel@nongnu.org; Fri, 30 Jan 2009 14:48:01 -0500 Received: from [199.232.76.173] (port=48777 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LSzLL-0006l5-8K for qemu-devel@nongnu.org; Fri, 30 Jan 2009 14:47:59 -0500 Received: from savannah.gnu.org ([199.232.41.3]:58092 helo=sv.gnu.org) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1LSzLK-0003tU-Ts for qemu-devel@nongnu.org; Fri, 30 Jan 2009 14:47:59 -0500 Received: from cvs.savannah.gnu.org ([199.232.41.69]) by sv.gnu.org with esmtp (Exim 4.63) (envelope-from ) id 1LSzLK-0003SD-En for qemu-devel@nongnu.org; Fri, 30 Jan 2009 19:47:58 +0000 Received: from aurel32 by cvs.savannah.gnu.org with local (Exim 4.63) (envelope-from ) id 1LSzLJ-0003S8-WE for qemu-devel@nongnu.org; Fri, 30 Jan 2009 19:47:58 +0000 MIME-Version: 1.0 Errors-To: aurel32 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Aurelien Jarno Message-Id: Date: Fri, 30 Jan 2009 19:47:58 +0000 Subject: [Qemu-devel] [6479] linux-user: return EINVAL on incorrect sockaddr Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Revision: 6479 http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=6479 Author: aurel32 Date: 2009-01-30 19:47:57 +0000 (Fri, 30 Jan 2009) Log Message: ----------- linux-user: return EINVAL on incorrect sockaddr From: Lauro Ramos Venancio Fixes ltp test accept01 Signed-off-by: Riku Voipio Signed-off-by: Aurelien Jarno Modified Paths: -------------- trunk/linux-user/syscall.c Modified: trunk/linux-user/syscall.c =================================================================== --- trunk/linux-user/syscall.c 2009-01-30 19:47:47 UTC (rev 6478) +++ trunk/linux-user/syscall.c 2009-01-30 19:47:57 UTC (rev 6479) @@ -1140,12 +1140,20 @@ return get_errno(socket(domain, type, protocol)); } +/* MAX_SOCK_ADDR from linux/net/socket.c */ +#define MAX_SOCK_ADDR 128 + /* do_bind() Must return target values and target errnos. */ static abi_long do_bind(int sockfd, abi_ulong target_addr, socklen_t addrlen) { - void *addr = alloca(addrlen); + void *addr; + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) + return -TARGET_EINVAL; + + addr = alloca(addrlen); + target_to_host_sockaddr(addr, target_addr, addrlen); return get_errno(bind(sockfd, addr, addrlen)); } @@ -1154,8 +1162,13 @@ static abi_long do_connect(int sockfd, abi_ulong target_addr, socklen_t addrlen) { - void *addr = alloca(addrlen); + void *addr; + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) + return -TARGET_EINVAL; + + addr = alloca(addrlen); + target_to_host_sockaddr(addr, target_addr, addrlen); return get_errno(connect(sockfd, addr, addrlen)); } @@ -1226,6 +1239,9 @@ if (get_user_u32(addrlen, target_addrlen_addr)) return -TARGET_EFAULT; + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) + return -TARGET_EINVAL; + addr = alloca(addrlen); ret = get_errno(accept(fd, addr, &addrlen)); @@ -1248,6 +1264,9 @@ if (get_user_u32(addrlen, target_addrlen_addr)) return -TARGET_EFAULT; + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) + return -TARGET_EINVAL; + addr = alloca(addrlen); ret = get_errno(getpeername(fd, addr, &addrlen)); @@ -1273,6 +1292,9 @@ if (get_user_u32(addrlen, target_addrlen_addr)) return -TARGET_EFAULT; + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) + return -TARGET_EINVAL; + addr = alloca(addrlen); ret = get_errno(getsockname(fd, addr, &addrlen)); @@ -1308,6 +1330,9 @@ void *host_msg; abi_long ret; + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) + return -TARGET_EINVAL; + host_msg = lock_user(VERIFY_READ, msg, len, 1); if (!host_msg) return -TARGET_EFAULT; @@ -1340,6 +1365,10 @@ ret = -TARGET_EFAULT; goto fail; } + if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) { + ret = -TARGET_EINVAL; + goto fail; + } addr = alloca(addrlen); ret = get_errno(recvfrom(fd, host_msg, len, flags, addr, &addrlen)); } else {