diff options
| author | bz <bz@FreeBSD.org> | 2011-09-28 08:47:17 +0000 |
|---|---|---|
| committer | bz <bz@FreeBSD.org> | 2011-09-28 08:47:17 +0000 |
| commit | 2e8e044c2fd777a22fe0e18a64666670c4b72dd7 (patch) | |
| tree | 6b2a5e897537e8defdf4089f141f835461cd9343 /sys/kern | |
| parent | 38b4a9842482e6817e8229e2fb567a4431b1924b (diff) | |
| download | FreeBSD-src-2e8e044c2fd777a22fe0e18a64666670c4b72dd7.zip FreeBSD-src-2e8e044c2fd777a22fe0e18a64666670c4b72dd7.tar.gz | |
Fix handling of corrupt compress(1)ed data. [11:04]
Add missing length checks on unix socket addresses. [11:05]
Approved by: so (cperciva)
Approved by: re (kensmith)
Security: FreeBSD-SA-11:04.compress
Security: CVE-2011-2895 [11:04]
Security: FreeBSD-SA-11:05.unix
Diffstat (limited to 'sys/kern')
| -rw-r--r-- | sys/kern/uipc_usrreq.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index 3a34f58..801a244 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -462,6 +462,8 @@ uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td) unp = sotounpcb(so); KASSERT(unp != NULL, ("uipc_bind: unp == NULL")); + if (soun->sun_len > sizeof(struct sockaddr_un)) + return (EINVAL); namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path); if (namelen <= 0) return (EINVAL); @@ -1252,6 +1254,8 @@ unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td) unp = sotounpcb(so); KASSERT(unp != NULL, ("unp_connect: unp == NULL")); + if (nam->sa_len > sizeof(struct sockaddr_un)) + return (EINVAL); len = nam->sa_len - offsetof(struct sockaddr_un, sun_path); if (len <= 0) return (EINVAL); |
