Module Name: src
Committed By: mlelstv
Date: Sat Oct 17 09:45:20 UTC 2020
Modified Files:
src/sys/kern: uipc_domain.c
Log Message:
validate unix socker buffer size and truncate path to prevent overflow.
To generate a diff of this commit:
cvs rdiff -u -r1.106 -r1.107 src/sys/kern/uipc_domain.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/uipc_domain.c
diff -u src/sys/kern/uipc_domain.c:1.106 src/sys/kern/uipc_domain.c:1.107
--- src/sys/kern/uipc_domain.c:1.106 Thu Dec 27 07:56:43 2018
+++ src/sys/kern/uipc_domain.c Sat Oct 17 09:45:20 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: uipc_domain.c,v 1.106 2018/12/27 07:56:43 maxv Exp $ */
+/* $NetBSD: uipc_domain.c,v 1.107 2020/10/17 09:45:20 mlelstv Exp $ */
/*
* Copyright (c) 1982, 1986, 1993
@@ -32,7 +32,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_domain.c,v 1.106 2018/12/27 07:56:43 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_domain.c,v 1.107 2020/10/17 09:45:20 mlelstv Exp $");
#include <sys/param.h>
#include <sys/socket.h>
@@ -412,6 +412,13 @@ static int
sun_print(char *buf, size_t len, const void *v)
{
const struct sockaddr_un *sun = v;
+ size_t plen;
+
+ KASSERT(sun->sun_len >= offsetof(struct sockaddr_un, sun_path[0]));
+ plen = sun->sun_len - offsetof(struct sockaddr_un, sun_path[0]);
+
+ len = MIN(len, plen);
+
return snprintf(buf, len, "%s", sun->sun_path);
}
