D36554.diff
No OneTemporary
Actions

Size

753 B

Referenced Files

None

Subscribers

None

D36554.diff
View Options

	diff --git a/sys/compat/freebsd32/freebsd32_misc.c b/sys/compat/freebsd32/freebsd32_misc.c
	--- a/sys/compat/freebsd32/freebsd32_misc.c
	+++ b/sys/compat/freebsd32/freebsd32_misc.c
	@@ -1556,15 +1556,19 @@
	break;
	}
	cm = (struct cmsghdr *)in1;
	- if (cm->cmsg_len < FREEBSD32_ALIGN(sizeof(*cm))) {
	+ if (cm->cmsg_len < FREEBSD32_ALIGN(sizeof(*cm)) \|\|
	+ cm->cmsg_len > buflen) {
	error = EINVAL;
	break;
	}
	msglen = FREEBSD32_ALIGN(cm->cmsg_len);
	- if (msglen > buflen \|\| msglen < cm->cmsg_len) {
	+ if (msglen < cm->cmsg_len) {
	error = EINVAL;
	break;
	}
	+ /* The native ABI permits the final padding to be omitted. */
	+ if (msglen > buflen)
	+ msglen = buflen;
	buflen -= msglen;

	in1 = (char *)in1 + msglen;