qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] [PULL v3 14/22] linux-user: Detect Negative Message Sizes i


From: riku . voipio
Subject: [Qemu-devel] [PULL v3 14/22] linux-user: Detect Negative Message Sizes in msgsnd System Call
Date: Fri, 22 Aug 2014 16:24:32 +0300

From: Tom Musta <address@hidden>

The msgsnd system call takes an argument that describes the message
size (msgsz) and is of type size_t.  The system call should set
errno to EINVAL in the event that a negative message size is passed.

Signed-off-by: Tom Musta <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Riku Voipio <address@hidden>
---
 linux-user/syscall.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index e754dbb..2549249 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2879,12 +2879,16 @@ struct target_msgbuf {
 };
 
 static inline abi_long do_msgsnd(int msqid, abi_long msgp,
-                                 unsigned int msgsz, int msgflg)
+                                 ssize_t msgsz, int msgflg)
 {
     struct target_msgbuf *target_mb;
     struct msgbuf *host_mb;
     abi_long ret = 0;
 
+    if (msgsz < 0) {
+        return -TARGET_EINVAL;
+    }
+
     if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
         return -TARGET_EFAULT;
     host_mb = malloc(msgsz+sizeof(long));
-- 
2.0.1




reply via email to

[Prev in Thread] Current Thread [Next in Thread]