[src/trunk]: src/sys/net PR/44054: Onno van der Linden: Stacksmashing in hand...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/dc93c3188f9c
branches:  trunk
changeset: 758514:dc93c3188f9c
user:      christos <christos%NetBSD.org@localhost>
date:      Sat Nov 06 17:17:13 2010 +0000

description:
PR/44054: Onno van der Linden: Stacksmashing in handling of ioctl OOSIO*
parameter.

diffstat:

 sys/net/if.c |  30 ++++++++++++++++++++++--------
 1 files changed, 22 insertions(+), 8 deletions(-)

diffs (58 lines):

diff -r 26afedfceda5 -r dc93c3188f9c sys/net/if.c
--- a/sys/net/if.c      Sat Nov 06 16:36:26 2010 +0000
+++ b/sys/net/if.c      Sat Nov 06 17:17:13 2010 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if.c,v 1.246 2010/11/02 22:34:21 christos Exp $        */
+/*     $NetBSD: if.c,v 1.247 2010/11/06 17:17:13 christos Exp $        */
 
 /*-
  * Copyright (c) 1999, 2000, 2001, 2008 The NetBSD Foundation, Inc.
@@ -90,7 +90,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if.c,v 1.246 2010/11/02 22:34:21 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if.c,v 1.247 2010/11/06 17:17:13 christos Exp $");
 
 #include "opt_inet.h"
 
@@ -1916,19 +1916,33 @@
 }
 
 int
-ifreq_setaddr(const u_long cmd, struct ifreq *ifr, const struct sockaddr *sa)
+ifreq_setaddr(u_long cmd, struct ifreq *ifr, const struct sockaddr *sa)
 {
        uint8_t len;
-       u_long ncmd;
+#ifdef COMPAT_OIFREQ
+       struct ifreq ifrb;
+       struct oifreq *oifr = NULL;
+       u_long ocmd = cmd;
+       cmd = compat_cvtcmd(cmd);
+       if (cmd != ocmd) {
+               oifr = (struct oifreq *)(void *)ifr;
+               ifr = &ifrb;
+               ifreqo2n(oifr, ifr);
+               len = sizeof(oifr->ifr_addr);
+       } else
+#endif
+               len = sizeof(ifr->ifr_ifru.ifru_space);
 
-       if ((ncmd = compat_cvtcmd(cmd)) != cmd)
-               len = sizeof(ifr->ifr_addr);
-       else
-               len = sizeof(ifr->ifr_ifru.ifru_space);
        if (len < sa->sa_len)
                return EFBIG;
+
        memset(&ifr->ifr_addr, 0, len);
        sockaddr_copy(&ifr->ifr_addr, len, sa);
+
+#ifdef COMPAT_OIFREQ
+       if (cmd != ocmd)
+               ifreqn2o(oifr, ifr);
+#endif
        return 0;
 }