Jason Thorpe <thorpej@nas.nasa.gov> writes:

> ***************
> *** 419,424 ****
> --- 419,426 ----
>   	int error;
>   	struct nameidata nd;
>   
> + 	if (nam->m_len > sizeof(struct sockaddr_un))
> + 		return (EINVAL);
>   	if (unp->unp_vnode != 0)
>   		return (EINVAL);
>   	NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT, UIO_SYSSPACE,

If we check length of socket name strictly, the XXX marked test just
after this NDINIT line (which tests special case that sun_path is 105
byte + nul in case of NetBSD/i386) can be eliminated, can't it?  Or,
supposed to be done in next step?

enami.