diff options
| author | cperciva <cperciva@FreeBSD.org> | 2004-11-28 19:16:00 +0000 |
|---|---|---|
| committer | cperciva <cperciva@FreeBSD.org> | 2004-11-28 19:16:00 +0000 |
| commit | 4984ccf9bbc5f5642f4ef09fca0635b5ea1cd16b (patch) | |
| tree | 324593ac5e009e2855d441b4c18f58073d9c1e65 /sys/kern/vfs_export.c | |
| parent | ffb27cac2ce82a918fb3333db1ee68cdef3ca930 (diff) | |
| download | FreeBSD-src-4984ccf9bbc5f5642f4ef09fca0635b5ea1cd16b.zip FreeBSD-src-4984ccf9bbc5f5642f4ef09fca0635b5ea1cd16b.tar.gz | |
Check that saddr->sa_family is a sensible value before using it.
Reported by: Bryan Fulton and Ted Unangst, Coverity, Inc.
Found by: The SWAT analysis tool
Diffstat (limited to 'sys/kern/vfs_export.c')
| -rw-r--r-- | sys/kern/vfs_export.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/kern/vfs_export.c b/sys/kern/vfs_export.c index dd21782..082bb0a 100644 --- a/sys/kern/vfs_export.c +++ b/sys/kern/vfs_export.c @@ -129,6 +129,10 @@ vfs_hang_addrlist(mp, nep, argp) saddr = (struct sockaddr *) (np + 1); if ((error = copyin(argp->ex_addr, saddr, argp->ex_addrlen))) goto out; + if (saddr->sa_family > SA_MAX) { + error = EINVAL; + goto out; + } if (saddr->sa_len > argp->ex_addrlen) saddr->sa_len = argp->ex_addrlen; if (argp->ex_masklen) { |
