mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-23 11:18:54 +00:00
Code Issues Releases Activity

Improve r250890, so that we stop processing of a message with zero

Browse Source 
descriptors as early as possible, and assert that number of descriptors
is positive in unp_freerights().

Reviewed by:	mjg, pjd, jilles
This commit is contained in:
Gleb Smirnoff 2013-06-04 11:19:08 +00:00
parent ab1aa38b02
commit 82e825c4c9
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=251374
1 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/kern/uipc_usrreq.c
View File

@ -1686,8 +1686,8 @@ unp_freerights(struct filedescent **fdep, int fdcount)
struct file *fp;
int i;
if (fdcount == 0)
return;
KASSERT(fdcount > 0, ("%s: fdcount %d", __func__, fdcount));
for (i = 0; i < fdcount; i++) {
fp = fdep[i]->fde_file;
filecaps_free(&fdep[i]->fde_caps);
@ -1725,6 +1725,8 @@ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
if (cm->cmsg_level == SOL_SOCKET
&& cm->cmsg_type == SCM_RIGHTS) {
newfds = datalen / sizeof(*fdep);
if (newfds == 0)
goto next;
fdep = data;
/* If we're not outputting the descriptors free them. */
@ -1770,8 +1772,7 @@ unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
unp_externalize_fp(fde->fde_file);
}
FILEDESC_XUNLOCK(fdesc);
if (newfds != 0)
free(fdep[0], M_FILECAPS);
free(fdep[0], M_FILECAPS);
} else {
/* We can just copy anything else across. */
if (error || controlp == NULL)
@ -1894,6 +1895,8 @@ unp_internalize(struct mbuf **controlp, struct thread *td)
case SCM_RIGHTS:
oldfds = datalen / sizeof (int);
if (oldfds == 0)
break;
/*
* Check that all the FDs passed in refer to legal
* files. If not, reject the entire operation.
@ -1928,10 +1931,6 @@ unp_internalize(struct mbuf **controlp, struct thread *td)
error = E2BIG;
goto out;
}
if (oldfds == 0) {
FILEDESC_SUNLOCK(fdesc);
break;
}
fdp = data;
fdep = (struct filedescent **)
CMSG_DATA(mtod(*controlp, struct cmsghdr *));