Attachment #45889 for bug #73802

View | Details | Raw Unified | Return to bug 73802
Collapse All | Expand All




#define __CMSG32_FIRSTHDR(ctl,len) \
	((len) >= sizeof(struct cmsghdr32) ? (struct cmsghdr32 *)(ctl) : (struct cmsghdr32 *)NULL)
#define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
	   ((ucmlen) >= sizeof(struct cmsghdr) && \
	    (ucmlen) <= (unsigned long) \
	    ((mhdr)->msg_controllen - \
	     ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))

static inline struct cmsghdr32 *
__cmsg32_nxthdr (void *ctl, __kernel_size_t size, struct cmsghdr32 *cmsg, int cmsg_len)

			return -EFAULT;

		/* Catch bogons. */
		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
			return -EINVAL;
		if ((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control) + ucmlen)
		    > kmsg->msg_controllen)
			return -EINVAL;

		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +




				    (struct cmsghdr32 *)(ctl) : \
				    (struct cmsghdr32 *)NULL)
#define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
	   ((ucmlen) >= sizeof(struct cmsghdr) && \
	    (ucmlen) <= (unsigned long) \
	    ((mhdr)->msg_controllen - \
	     ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))

struct msghdr32
{

			return -EFAULT;

		/* Catch bogons. */
		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
		   CMSG32_ALIGN(sizeof(struct cmsghdr32)))
			return -EINVAL;
		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
				   + ucmlen) > kmsg->msg_controllen)
			return -EINVAL;

		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +




				    (struct cmsghdr32 *)(ctl) : \
				    (struct cmsghdr32 *)NULL)
#define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
	   ((ucmlen) >= sizeof(struct cmsghdr) && \
	    (ucmlen) <= (unsigned long) \
	    ((mhdr)->msg_controllen - \
	     ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))

__inline__ struct cmsghdr32 *__cmsg32_nxthdr(void *__ctl, __kernel_size_t __size,
					      struct cmsghdr32 *__cmsg, int __cmsg_len)

			return -EFAULT;

		/* Catch bogons. */
		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
		   CMSG32_ALIGN(sizeof(struct cmsghdr32)))
			return -EINVAL;
		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
				   + ucmlen) > kmsg->msg_controllen)
			return -EINVAL;

		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +

Lines 136-146 static int cmsghdr_from_user32_to_kern(s Link Here

(-)linux-2.4.21.orig/arch/x86_64/ia32/socket32.c (-5 / +1 lines)
136	return -EFAULT;	136	return -EFAULT;
137		137
138	/* Catch bogons. */	138	/* Catch bogons. */
139	if(CMSG32_ALIGN(ucmlen) <	139	if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
140	CMSG32_ALIGN(sizeof(struct cmsghdr32)))
141	return -EINVAL;
142	if((unsigned long)(((char )ucmsg - (char )kmsg->msg_control)
143	+ ucmlen) > kmsg->msg_controllen)
144	return -EINVAL;	140	return -EINVAL;
145	if (kmsg->msg_controllen > 65536)	141	if (kmsg->msg_controllen > 65536)
146	return -EINVAL;	142	return -EINVAL;

Lines 45-50 struct cmsghdr32 { Link Here

(-)linux-2.4.21.orig/include/asm-x86_64/socket32.h (+5 lines)
45	(struct cmsghdr32 *)(ctl) : \	45	(struct cmsghdr32 *)(ctl) : \
46	(struct cmsghdr32 *)NULL)	46	(struct cmsghdr32 *)NULL)
47	#define CMSG32_FIRSTHDR(msg) __CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)	47	#define CMSG32_FIRSTHDR(msg) __CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
		48	#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
		49	((ucmlen) >= sizeof(struct cmsghdr) && \
		50	(ucmlen) <= (unsigned long) \
		51	((mhdr)->msg_controllen - \
		52	((char )(ucmsg) - (char )(mhdr)->msg_control)))
48		53
49	__inline__ struct cmsghdr32 __cmsg32_nxthdr(void __ctl, __kernel_size_t __size,	54	__inline__ struct cmsghdr32 __cmsg32_nxthdr(void __ctl, __kernel_size_t __size,
50	struct cmsghdr32 *__cmsg, int __cmsg_len)	55	struct cmsghdr32 *__cmsg, int __cmsg_len)

Return to bug 73802

Lines 1330-1335 struct cmsghdr32 { Link Here

(-)linux-2.4.21.orig/arch/ia64/ia32/sys_ia32.c (-4 / +6 lines)
1330	#define __CMSG32_FIRSTHDR(ctl,len) \	1330	#define __CMSG32_FIRSTHDR(ctl,len) \
1331	((len) >= sizeof(struct cmsghdr32) ? (struct cmsghdr32 )(ctl) : (struct cmsghdr32 )NULL)	1331	((len) >= sizeof(struct cmsghdr32) ? (struct cmsghdr32 )(ctl) : (struct cmsghdr32 )NULL)
1332	#define CMSG32_FIRSTHDR(msg) __CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)	1332	#define CMSG32_FIRSTHDR(msg) __CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
		1333	#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
		1334	((ucmlen) >= sizeof(struct cmsghdr) && \
		1335	(ucmlen) <= (unsigned long) \
		1336	((mhdr)->msg_controllen - \
		1337	((char )(ucmsg) - (char )(mhdr)->msg_control)))
1333		1338
1334	static inline struct cmsghdr32 *	1339	static inline struct cmsghdr32 *
1335	__cmsg32_nxthdr (void ctl, __kernel_size_t size, struct cmsghdr32 cmsg, int cmsg_len)	1340	__cmsg32_nxthdr (void ctl, __kernel_size_t size, struct cmsghdr32 cmsg, int cmsg_len)
Lines 1390-1399 get_cmsghdr32 (struct msghdr *kmsg, unsi Link Here
1390	return -EFAULT;	1395	return -EFAULT;
1391		1396
1392	/* Catch bogons. */	1397	/* Catch bogons. */
1393	if (CMSG32_ALIGN(ucmlen) < CMSG32_ALIGN(sizeof(struct cmsghdr32)))	1398	if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
1394	return -EINVAL;
1395	if ((unsigned long)(((char )ucmsg - (char )kmsg->msg_control) + ucmlen)
1396	> kmsg->msg_controllen)
1397	return -EINVAL;	1399	return -EINVAL;
1398		1400
1399	tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +	1401	tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +

Lines 3308-3313 asmlinkage long sys32_setsockopt(int fd, Link Here

(-)linux-2.4.21.orig/arch/ppc64/kernel/sys_ppc32.c (-5 / +6 lines)
3308	(struct cmsghdr32 *)(ctl) : \	3308	(struct cmsghdr32 *)(ctl) : \
3309	(struct cmsghdr32 *)NULL)	3309	(struct cmsghdr32 *)NULL)
3310	#define CMSG32_FIRSTHDR(msg) __CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)	3310	#define CMSG32_FIRSTHDR(msg) __CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
		3311	#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
		3312	((ucmlen) >= sizeof(struct cmsghdr) && \
		3313	(ucmlen) <= (unsigned long) \
		3314	((mhdr)->msg_controllen - \
		3315	((char )(ucmsg) - (char )(mhdr)->msg_control)))
3311		3316
3312	struct msghdr32	3317	struct msghdr32
3313	{	3318	{
Lines 3483-3493 static int cmsghdr_from_user32_to_kern(s Link Here
3483	return -EFAULT;	3488	return -EFAULT;
3484		3489
3485	/* Catch bogons. */	3490	/* Catch bogons. */
3486	if(CMSG32_ALIGN(ucmlen) <	3491	if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
3487	CMSG32_ALIGN(sizeof(struct cmsghdr32)))
3488	return -EINVAL;
3489	if((unsigned long)(((char )ucmsg - (char )kmsg->msg_control)
3490	+ ucmlen) > kmsg->msg_controllen)
3491	return -EINVAL;	3492	return -EINVAL;
3492		3493
3493	tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +	3494	tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +

Lines 2333-2338 struct cmsghdr32 { Link Here

(-)linux-2.4.21.orig/arch/s390x/kernel/linux32.c (-5 / +6 lines)
2333	(struct cmsghdr32 *)(ctl) : \	2333	(struct cmsghdr32 *)(ctl) : \
2334	(struct cmsghdr32 *)NULL)	2334	(struct cmsghdr32 *)NULL)
2335	#define CMSG32_FIRSTHDR(msg) __CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)	2335	#define CMSG32_FIRSTHDR(msg) __CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
		2336	#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
		2337	((ucmlen) >= sizeof(struct cmsghdr) && \
		2338	(ucmlen) <= (unsigned long) \
		2339	((mhdr)->msg_controllen - \
		2340	((char )(ucmsg) - (char )(mhdr)->msg_control)))
2336		2341
2337	__inline__ struct cmsghdr32 __cmsg32_nxthdr(void __ctl, __kernel_size_t __size,	2342	__inline__ struct cmsghdr32 __cmsg32_nxthdr(void __ctl, __kernel_size_t __size,
2338	struct cmsghdr32 *__cmsg, int __cmsg_len)	2343	struct cmsghdr32 *__cmsg, int __cmsg_len)
Lines 2459-2469 static int cmsghdr_from_user32_to_kern(s Link Here
2459	return -EFAULT;	2464	return -EFAULT;
2460		2465
2461	/* Catch bogons. */	2466	/* Catch bogons. */
2462	if(CMSG32_ALIGN(ucmlen) <	2467	if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
2463	CMSG32_ALIGN(sizeof(struct cmsghdr32)))
2464	return -EINVAL;
2465	if((unsigned long)(((char )ucmsg - (char )kmsg->msg_control)
2466	+ ucmlen) > kmsg->msg_controllen)
2467	return -EINVAL;	2468	return -EINVAL;
2468		2469
2469	tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +	2470	tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +