diff options
| author | Andrey A. Chernov <ache@FreeBSD.org> | 1999-05-21 15:54:40 +0000 |
|---|---|---|
| committer | Andrey A. Chernov <ache@FreeBSD.org> | 1999-05-21 15:54:40 +0000 |
| commit | 925fa5c3f50d1be47d51704cd3fb2b4cd07d969f (patch) | |
| tree | 58d766f5fd43fc27506c0a8ea60d8def3f4b8493 /sys/kern/uipc_socket.c | |
| parent | 13c655ab1a94072465374cf25552f0234ec7ce92 (diff) | |
| download | src-925fa5c3f50d1be47d51704cd3fb2b4cd07d969f.tar.gz src-925fa5c3f50d1be47d51704cd3fb2b4cd07d969f.zip | |
Realy fix overflow on SO_*TIMEO
Submitted by: bde
Notes
Notes:
svn path=/head/; revision=47364
Diffstat (limited to 'sys/kern/uipc_socket.c')
| -rw-r--r-- | sys/kern/uipc_socket.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index cfae9c131b98..4f2c486463ad 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)uipc_socket.c 8.3 (Berkeley) 4/15/94 - * $Id: uipc_socket.c,v 1.56 1999/04/24 18:22:34 ache Exp $ + * $Id: uipc_socket.c,v 1.57 1999/05/03 23:57:23 billf Exp $ */ #include <sys/param.h> @@ -955,7 +955,7 @@ sosetopt(so, sopt) int error, optval; struct linger l; struct timeval tv; - short val; + u_long val; error = 0; if (sopt->sopt_level != SOL_SOCKET) { @@ -1049,11 +1049,19 @@ sosetopt(so, sopt) if (error) goto bad; - if (tv.tv_sec * hz + tv.tv_usec / tick > SHRT_MAX) { + /* assert(hz > 0); */ + if (tv.tv_sec < 0 || tv.tv_sec > SHRT_MAX / hz || + tv.tv_usec < 0 || tv.tv_usec >= 1000000) { + error = EDOM; + goto bad; + } + /* assert(tick > 0); */ + /* assert(ULONG_MAX - SHRT_MAX >= 1000000); */ + val = (u_long)(tv.tv_sec * hz) + tv.tv_usec / tick; + if (val > SHRT_MAX) { error = EDOM; goto bad; } - val = tv.tv_sec * hz + tv.tv_usec / tick; switch (sopt->sopt_name) { case SO_SNDTIMEO: |