aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTom Musta <tommusta@gmail.com>2014-08-12 13:53:37 -0500
committerRiku Voipio <riku.voipio@linaro.org>2014-08-22 15:06:35 +0300
commitedcc5f9dc39309d32f4b3737e6b750ae967f5bbd (patch)
treee1e2948466ac9057566dff7aa8e4b5d10b62c6ee
parentb6ce1f6b90903961f66b0aec7be75d6c94560e40 (diff)
downloadqemu-arm-edcc5f9dc39309d32f4b3737e6b750ae967f5bbd.tar.gz
linux-user: Detect Negative Message Sizes in msgsnd System Call
The msgsnd system call takes an argument that describes the message size (msgsz) and is of type size_t. The system call should set errno to EINVAL in the event that a negative message size is passed. Signed-off-by: Tom Musta <tommusta@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
-rw-r--r--linux-user/syscall.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index e754dbb3fa..2549249a08 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2879,12 +2879,16 @@ struct target_msgbuf {
};
static inline abi_long do_msgsnd(int msqid, abi_long msgp,
- unsigned int msgsz, int msgflg)
+ ssize_t msgsz, int msgflg)
{
struct target_msgbuf *target_mb;
struct msgbuf *host_mb;
abi_long ret = 0;
+ if (msgsz < 0) {
+ return -TARGET_EINVAL;
+ }
+
if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
return -TARGET_EFAULT;
host_mb = malloc(msgsz+sizeof(long));