⬢ DragonFlyBSD Kernel Audit
DF-3372 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -309,6 +309,11 @@
 
 	COMMON_START(so, inp, 0);
 
+	if (nam->sa_len < sizeof(struct sockaddr_in)) {
+		error = EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Must check for multicast addresses and disallow binding
 	 * to them.
@@ -399,6 +404,11 @@
 
 	COMMON_START(so, inp, 0);
 
+	if (nam->sa_len < sizeof(struct sockaddr_in6)) {
+		error = EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Must check for multicast addresses and disallow binding
 	 * to them.
@@ -591,6 +601,11 @@
 
 	COMMON_START(so, inp, 0);
 
+	if (nam->sa_len < sizeof(struct sockaddr_in)) {
+		error = EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Must disallow TCP ``connections'' to multicast addresses.
 	 */
@@ -634,6 +649,11 @@
 
 	COMMON_START(so, inp, 0);
 
+	if (nam->sa_len < sizeof(struct sockaddr_in6)) {
+		error = EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Must disallow TCP ``connections'' to multicast addresses.
 	 */
@@ -962,6 +982,9 @@
 {
 	const struct sockaddr_in *sinp;
 
+	if (nam->sa_len < sizeof(struct sockaddr_in))
+		return EINVAL;
+
 	sinp = (const struct sockaddr_in *)nam;
 	if (sinp->sin_family == AF_INET &&
 	    IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))