Module Name: src
Committed By: mlelstv
Date: Fri Sep 27 08:17:12 UTC 2019
Modified Files:
src/sys/compat/netbsd32: netbsd32_socket.c
Log Message:
Ensure failure if resid goes negative.
To generate a diff of this commit:
cvs rdiff -u -r1.51 -r1.52 src/sys/compat/netbsd32/netbsd32_socket.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/netbsd32/netbsd32_socket.c
diff -u src/sys/compat/netbsd32/netbsd32_socket.c:1.51 src/sys/compat/netbsd32/netbsd32_socket.c:1.52
--- src/sys/compat/netbsd32/netbsd32_socket.c:1.51 Fri Sep 27 08:12:01 2019
+++ src/sys/compat/netbsd32/netbsd32_socket.c Fri Sep 27 08:17:11 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: netbsd32_socket.c,v 1.51 2019/09/27 08:12:01 mlelstv Exp $ */
+/* $NetBSD: netbsd32_socket.c,v 1.52 2019/09/27 08:17:11 mlelstv Exp $ */
/*
* Copyright (c) 1998, 2001 Matthew R. Green
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.51 2019/09/27 08:12:01 mlelstv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.52 2019/09/27 08:17:11 mlelstv Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -403,7 +403,8 @@ copyin32_msg_control(struct lwp *l, stru
/*
* Sanity check the control message length.
*/
- if (cmsg32.cmsg_len > (size_t)resid ||
+ if (resid < 0 ||
+ cmsg32.cmsg_len > (size_t)resid ||
cmsg32.cmsg_len < sizeof(cmsg32)) {
error = EINVAL;
goto failure;
