Commit 682610a9 authored by Andrei Vagin's avatar Andrei Vagin Committed by Andrei Vagin

unix: check that a length of a socket is less than UNIX_PATH_MAX

CID 190774 (#1 of 1): Out-of-bounds access (OVERRUN)
5. overrun-buffer-arg: Overrunning array addr.sun_path of 108 bytes by
passing it to a function which accesses it at byte offset 4094 using
argument ui->ue->name.len (which evaluates to 4095).
Signed-off-by: 's avatarAndrei Vagin <avagin@virtuozzo.com>
parent 80d2c215
......@@ -1408,7 +1408,7 @@ static int bind_on_deleted(int sk, struct unix_sk_info *ui)
bool renamed = false;
int ret;
if (ui->ue->name.len >= sizeof(path)) {
if (ui->ue->name.len >= sizeof(UNIX_PATH_MAX)) {
pr_err("ghost: Too long name for socket id %#x ino %d name %s\n",
ui->ue->id, ui->ue->ino, ui->name);
return -ENOSPC;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment