[Midnightbsd-cvs] src [7554] trunk/sys/kern/uipc_syscalls.c: Validate that user supplied control message length is not negative.

[laffer1 at midnightbsd.org]

Revision: 7554
          http://svnweb.midnightbsd.org/src/?rev=7554
Author:   laffer1
Date:     2016-05-19 08:31:02 -0400 (Thu, 19 May 2016)
Log Message:
-----------
Validate that user supplied control message length is not negative.

Obtained from: FreeBSD

Modified Paths:
--------------
    trunk/sys/kern/uipc_syscalls.c

Modified: trunk/sys/kern/uipc_syscalls.c
===================================================================
--- trunk/sys/kern/uipc_syscalls.c	2016-05-19 12:27:03 UTC (rev 7553)
+++ trunk/sys/kern/uipc_syscalls.c	2016-05-19 12:31:02 UTC (rev 7554)
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$MidnightBSD: src/sys/kern/uipc_syscalls.c,v 1.7 2012/10/09 04:08:16 laffer1 Exp $");
+__FBSDID("$MidnightBSD$");
 
 #include "opt_capsicum.h"
 #include "opt_inet.h"
@@ -1654,6 +1654,9 @@
 	struct mbuf *m;
 	int error;
 
+	if (buflen < 0)
+		return (EINVAL);
+
 	if ((u_int)buflen > MLEN) {
 #ifdef COMPAT_OLDSOCK
 		if (type == MT_SONAME && (u_int)buflen <= 112)