diff options
| author | Thomas Nordin <nordin@cvs.openbsd.org> | 2002-02-05 22:04:44 +0000 |
|---|---|---|
| committer | Thomas Nordin <nordin@cvs.openbsd.org> | 2002-02-05 22:04:44 +0000 |
| commit | 9b9d2e5a89423d53b637abe309fd2a30fd1b0f88 (patch) | |
| tree | 083bd6cae651a29f09c81d2f0533f1d1fe43b966 | |
| parent | 95104ca27088752350fb3d77bcdf87584451b1fa (diff) | |
Do range check on SO_LINGER, closes pr#2375. art@ ok
| -rw-r--r-- | sys/kern/uipc_socket.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index e667e230798..6feeb3c4118 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uipc_socket.c,v 1.40 2002/01/23 00:39:48 art Exp $ */ +/* $OpenBSD: uipc_socket.c,v 1.41 2002/02/05 22:04:43 nordin Exp $ */ /* $NetBSD: uipc_socket.c,v 1.21 1996/02/04 02:17:52 christos Exp $ */ /* @@ -935,7 +935,9 @@ sosetopt(so, level, optname, m0) switch (optname) { case SO_LINGER: - if (m == NULL || m->m_len != sizeof (struct linger)) { + if (m == NULL || m->m_len != sizeof (struct linger) || + mtod(m, struct linger *)->l_linger < 0 || + mtod(m, struct linger *)->l_linger > SHRT_MAX) { error = EINVAL; goto bad; } |