[src/trunk]: src/sys/kern Return EINVAL if namelen isn't large enough to enco...

[rtr <rtr%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/036d5a5ddd49
branches:  trunk
changeset: 806703:036d5a5ddd49
user:      rtr <rtr%NetBSD.org@localhost>
date:      Fri Mar 06 03:35:00 2015 +0000

description:
Return EINVAL if namelen isn't large enough to encompass the expected
members of sockaddr structures. i.e. sa_len and sa_family.

Discussed with and patch by christos@

diffstat:

 sys/kern/uipc_syscalls.c |  10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diffs (31 lines):

diff -r 50d23af2a5c1 -r 036d5a5ddd49 sys/kern/uipc_syscalls.c
--- a/sys/kern/uipc_syscalls.c  Fri Mar 06 02:55:11 2015 +0000
+++ b/sys/kern/uipc_syscalls.c  Fri Mar 06 03:35:00 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: uipc_syscalls.c,v 1.173 2014/09/05 09:20:59 matt Exp $ */
+/*     $NetBSD: uipc_syscalls.c,v 1.174 2015/03/06 03:35:00 rtr Exp $  */
 
 /*-
  * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.173 2014/09/05 09:20:59 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.174 2015/03/06 03:35:00 rtr Exp $");
 
 #include "opt_pipe.h"
 
@@ -1463,6 +1463,12 @@
        if (buflen > (type == MT_SONAME ? UCHAR_MAX : PAGE_SIZE))
                return EINVAL;
 
+       /*
+        * length must greater than sizeof(sa_family) + sizeof(sa_len)
+        */
+       if (type == MT_SONAME && buflen <= 2)
+               return EINVAL;
+
        /* Allocate an mbuf to hold the arguments. */
        m = m_get(M_WAIT, type);
        /* can't claim.  don't who to assign it to. */