Validate that user supplied control message length is not negative.

Submitted by: C Turt <cturt hardenedbsd.org> Security: SA-16:19 Security: CVE-2016-1887
freebsd · May 17, 2016 · 5e838e0 · 5e838e0
1 parent 1d7ec4d
commit 5e838e0
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
@@ -1699,6 +1699,9 @@ sockargs(mp, buf, buflen, type)
 	struct mbuf *m;
 	int error;
 
+	if (buflen < 0)
+		return (EINVAL);
+
 	if (buflen > MLEN) {
 #ifdef COMPAT_OLDSOCK
 		if (type == MT_SONAME && buflen <= 112)