diff options
| author | cperciva <cperciva@FreeBSD.org> | 2011-10-04 19:07:38 +0000 |
|---|---|---|
| committer | cperciva <cperciva@FreeBSD.org> | 2011-10-04 19:07:38 +0000 |
| commit | 1485b2ad01c1e0d5adfdbcc6d06114ecaa15a950 (patch) | |
| tree | 92dfae97850af8d9e9708521200ac72fee06be92 /sys/compat/linux/linux_socket.c | |
| parent | cc9fd3ad5383affc8a0eb5db3fe3cdbedf00ef85 (diff) | |
| download | FreeBSD-src-1485b2ad01c1e0d5adfdbcc6d06114ecaa15a950.zip FreeBSD-src-1485b2ad01c1e0d5adfdbcc6d06114ecaa15a950.tar.gz | |
Fix a bug in UNIX socket handling in the linux emulator which was
exposed by the security fix in FreeBSD-SA-11:05.unix.
Approved by: so (cperciva)
Approved by: re (kib)
Security: Related to FreeBSD-SA-11:05.unix, but not actually
a security fix.
Diffstat (limited to 'sys/compat/linux/linux_socket.c')
| -rw-r--r-- | sys/compat/linux/linux_socket.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/sys/compat/linux/linux_socket.c b/sys/compat/linux/linux_socket.c index 7568c82..a86a23f 100644 --- a/sys/compat/linux/linux_socket.c +++ b/sys/compat/linux/linux_socket.c @@ -104,6 +104,7 @@ do_sa_get(struct sockaddr **sap, const struct osockaddr *osa, int *osalen, int oldv6size; struct sockaddr_in6 *sin6; #endif + int namelen; if (*osalen < 2 || *osalen > UCHAR_MAX || !osa) return (EINVAL); @@ -166,6 +167,20 @@ do_sa_get(struct sockaddr **sap, const struct osockaddr *osa, int *osalen, } } + if ((bdom == AF_LOCAL) && (*osalen > sizeof(struct sockaddr_un))) { + for (namelen = 0; + namelen < *osalen - offsetof(struct sockaddr_un, sun_path); + namelen++) + if (!((struct sockaddr_un *)kosa)->sun_path[namelen]) + break; + if (namelen + offsetof(struct sockaddr_un, sun_path) > + sizeof(struct sockaddr_un)) { + error = EINVAL; + goto out; + } + alloclen = sizeof(struct sockaddr_un); + } + sa = (struct sockaddr *) kosa; sa->sa_family = bdom; sa->sa_len = alloclen; |
