diff options
| -rw-r--r-- | sys/kern/uipc_sockbuf.c | 2 | ||||
| -rw-r--r-- | sys/kern/uipc_socket2.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c index d71806b4d15b..c1072b7eeaa1 100644 --- a/sys/kern/uipc_sockbuf.c +++ b/sys/kern/uipc_sockbuf.c @@ -839,6 +839,8 @@ sbcreatecontrol(p, size, type, level) register struct cmsghdr *cp; struct mbuf *m; + if ((u_int)size > MLEN) + return ((struct mbuf *) NULL); if ((m = m_get(M_DONTWAIT, MT_CONTROL)) == NULL) return ((struct mbuf *) NULL); cp = mtod(m, struct cmsghdr *); diff --git a/sys/kern/uipc_socket2.c b/sys/kern/uipc_socket2.c index d71806b4d15b..c1072b7eeaa1 100644 --- a/sys/kern/uipc_socket2.c +++ b/sys/kern/uipc_socket2.c @@ -839,6 +839,8 @@ sbcreatecontrol(p, size, type, level) register struct cmsghdr *cp; struct mbuf *m; + if ((u_int)size > MLEN) + return ((struct mbuf *) NULL); if ((m = m_get(M_DONTWAIT, MT_CONTROL)) == NULL) return ((struct mbuf *) NULL); cp = mtod(m, struct cmsghdr *); |