Module Name: src Committed By: martin Date: Wed Nov 21 12:09:54 UTC 2018
Modified Files: src/sys/compat/netbsd32 [netbsd-7-1]: netbsd32_socket.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1652): sys/compat/netbsd32/netbsd32_socket.c: revision 1.48 (via patch) Fix inverted logic, which leads to buffer overflow. Detected by kASan. To generate a diff of this commit: cvs rdiff -u -r1.41.14.1 -r1.41.14.1.6.1 \ src/sys/compat/netbsd32/netbsd32_socket.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/compat/netbsd32/netbsd32_socket.c diff -u src/sys/compat/netbsd32/netbsd32_socket.c:1.41.14.1 src/sys/compat/netbsd32/netbsd32_socket.c:1.41.14.1.6.1 --- src/sys/compat/netbsd32/netbsd32_socket.c:1.41.14.1 Sat Aug 8 15:41:54 2015 +++ src/sys/compat/netbsd32/netbsd32_socket.c Wed Nov 21 12:09:54 2018 @@ -1,4 +1,4 @@ -/* $NetBSD: netbsd32_socket.c,v 1.41.14.1 2015/08/08 15:41:54 martin Exp $ */ +/* $NetBSD: netbsd32_socket.c,v 1.41.14.1.6.1 2018/11/21 12:09:54 martin Exp $ */ /* * Copyright (c) 1998, 2001 Matthew R. Green @@ -27,7 +27,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.41.14.1 2015/08/08 15:41:54 martin Exp $"); +__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.41.14.1.6.1 2018/11/21 12:09:54 martin Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -99,7 +99,7 @@ copyout32_msg_control_mbuf(struct lwp *l } ktrkuser("msgcontrol", cmsg, cmsg->cmsg_len); - error = copyout(&cmsg32, *q, MAX(i, sizeof(cmsg32))); + error = copyout(&cmsg32, *q, MIN(i, sizeof(cmsg32))); if (error) return (error); if (i > CMSG32_LEN(0)) {