RepoMirrors
/
mars
mirror of https://github.com/schoebel/mars
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

net: safeguard recv of bad string size

This commit is contained in:
Thomas Schoebel-Theuer 2020-11-07 07:57:22 +01:00
parent 26bab9b43d
commit 530a938a62
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
kernel/mars_net.c
View File

@ -984,11 +984,20 @@ int _desc_recv_item(struct mars_socket *msock, void *data, const struct mars_des
status = mars_recv_raw(msock, &len, sizeof(len), sizeof(len));
if (unlikely(status < 0))
goto done;
if (unlikely(len < 0 || len > KMALLOC_MAX_SIZE)) {
MARS_ERR("#%d bad string alloc size %d\n",
msock->s_debug_nr, len);
status = -EOVERFLOW;
goto done;
}
if (len > 0 && item) {
char *str = _brick_string_alloc(len, line);
if (unlikely(!str)) {
MARS_ERR("#%d string alloc error\n", msock->s_debug_nr);
MARS_ERR("#%d string alloc error\n",
msock->s_debug_nr);
status = -ENOMEM;
goto done;
}
*(void**)item = str;