[SPARC64]: Fix cmsg length checks in Solaris emulation layer.
Linux Kernel Mailing List <[email protected]> Fri, 24 Jun 2005 10:14:25 -0700
| Newsgroups | gmane.linux.kernel.commits.2-4 |
|---|---|
| Message-ID | <[email protected]> |
tree 42c1469bbc7081f46411c25cf43ebe15651525a4 parent bc4a598be8faad234847a448516708ee9c1b427f author David S. Miller <[email protected]> Mon, 20 Jun 2005 10:23:14 -0700 committer David S. Miller <[email protected]> Mon, 20 Jun 2005 10:23:14 -0700 [SPARC64]: Fix cmsg length checks in Solaris emulation layer. Signed-off-by: David S. Miller <[email protected]> arch/sparc64/solaris/socket.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/sparc64/solaris/socket.c b/arch/sparc64/solaris/socket.c --- a/arch/sparc64/solaris/socket.c +++ b/arch/sparc64/solaris/socket.c @@ -410,8 +410,10 @@ asmlinkage int solaris_sendmsg(int fd, s unsigned long *kcmsg; __kernel_size_t32 cmlen; - if(kern_msg.msg_controllen > sizeof(ctl) && - kern_msg.msg_controllen <= 256) { + if (kern_msg.msg_controllen <= sizeof(__kernel_size_t32)) + return -EINVAL; + + if(kern_msg.msg_controllen > sizeof(ctl)) { err = -ENOBUFS; ctl_buf = kmalloc(kern_msg.msg_controllen, GFP_KERNEL); if(!ctl_buf)