Skip to content

Commit

Permalink
Avoid -LONG_MIN msgtyp in msgrcv(2) and treat it as LONG_MAX
Browse files Browse the repository at this point in the history 
This logic (found in Linux) avoids undefined behavior.

Reported-by: syzbot+8af00519a8688d9903ca@syzkaller.appspotmail.com
  • Loading branch information
@krytarowski
krytarowski committed Oct 4, 2019
1 parent 2ab41a9 commit fa6363e
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions sys/kern/sysv_msg.c
View file
@@ -1,4 +1,4 @@
/* $NetBSD: sysv_msg.c,v 1.75 2019/08/07 00:38:02 pgoyette Exp $ */
/* $NetBSD: sysv_msg.c,v 1.76 2019/10/04 23:20:22 kamil Exp $ */

/*-
* Copyright (c) 1999, 2006, 2007 The NetBSD Foundation, Inc.
Expand Down Expand Up @@ -50,7 +50,7 @@
*/

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.75 2019/08/07 00:38:02 pgoyette Exp $");
__KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.76 2019/10/04 23:20:22 kamil Exp $");

#ifdef _KERNEL_OPT
#include "opt_sysv.h"
Expand Down Expand Up @@ -1100,6 +1100,7 @@ msgrcv1(struct lwp *l, int msqidr, char *user_msgp, size_t msgsz, long msgtyp,
*/

if (msgtyp != msghdr->msg_type &&
msgtyp != LONG_MIN &&
msghdr->msg_type > -msgtyp)
continue;

Expand Down

0 comments on commit fa6363e

Please sign in to comment.