diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2021-05-03 16:51:04 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-05-03 17:35:19 +0000 |
| commit | f161d294b92732df6254a89f393ab24999e122bf (patch) | |
| tree | 3b0c4e481060d66ae8cdad006c1569e3ca4a5520 /sys/netgraph | |
| parent | a3c7da3d08eec921f16a32c4c716b896385264e9 (diff) | |
Diffstat (limited to 'sys/netgraph')
| -rw-r--r-- | sys/netgraph/ng_socket.c | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/sys/netgraph/ng_socket.c b/sys/netgraph/ng_socket.c index 865e9dd7948f..1c67099a4dc4 100644 --- a/sys/netgraph/ng_socket.c +++ b/sys/netgraph/ng_socket.c @@ -240,11 +240,16 @@ ngc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr, goto release; } + if (sap->sg_len > NG_NODESIZ + offsetof(struct sockaddr_ng, sg_data)) { + error = EINVAL; + goto release; + } + /* * Allocate an expendable buffer for the path, chop off * the sockaddr header, and make sure it's NUL terminated. */ - len = sap->sg_len - 2; + len = sap->sg_len - offsetof(struct sockaddr_ng, sg_data); path = malloc(len + 1, M_NETGRAPH_PATH, M_WAITOK); bcopy(sap->sg_data, path, len); path[len] = '\0'; @@ -422,10 +427,16 @@ ngd_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr, goto release; } - if (sap == NULL) + if (sap == NULL) { len = 0; /* Make compiler happy. */ - else - len = sap->sg_len - 2; + } else { + if (sap->sg_len > NG_NODESIZ + + offsetof(struct sockaddr_ng, sg_data)) { + error = EINVAL; + goto release; + } + len = sap->sg_len - offsetof(struct sockaddr_ng, sg_data); + } /* * If the user used any of these ways to not specify an address |