diff options
| author | Dmitry Chagin <dchagin@FreeBSD.org> | 2022-04-11 20:32:28 +0000 |
|---|---|---|
| committer | Dmitry Chagin <dchagin@FreeBSD.org> | 2022-04-11 20:32:28 +0000 |
| commit | bb0f644cd680d20b3112f6c14dc853171f497a88 (patch) | |
| tree | 27c0d1d45bd695e0ccc25071a2b1b39645b97522 | |
| parent | 68bfaefb3d93781730ebc63956538154173b77c8 (diff) | |
| download | src-bb0f644cd680d20b3112f6c14dc853171f497a88.tar.gz src-bb0f644cd680d20b3112f6c14dc853171f497a88.zip | |
linux(4): Limit user-supplied sockaddr length in recvfrom().
Differential Revision: https://reviews.freebsd.org/D34726
| -rw-r--r-- | sys/compat/linux/linux_socket.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/compat/linux/linux_socket.c b/sys/compat/linux/linux_socket.c index 16e8c7dadb98..622e25651dbb 100644 --- a/sys/compat/linux/linux_socket.c +++ b/sys/compat/linux/linux_socket.c @@ -1272,6 +1272,7 @@ linux_recvfrom(struct thread *td, struct linux_recvfrom_args *args) return (error); if (fromlen < 0) return (EINVAL); + fromlen = min(fromlen, SOCK_MAXADDRLEN); sa = malloc(fromlen, M_SONAME, M_WAITOK); } else { fromlen = 0; |