STABLE14-windows-pioctl-buffer-overrun-20070609

this patch protects against a buffer overrun in the client if the
server were to send more data than the receiving buffer can hold.


(cherry picked from commit 8a814a5596e9d8db1c24326715f794ae46966b3b)
This commit is contained in:
Asanka Herath 2007-06-10 06:54:10 +00:00 committed by Jeffrey Altman
parent b10041bbe7
commit 35dda98c65

View File

@ -844,6 +844,10 @@ pioctl(char *pathp, long opcode, struct ViceIoctl *blobp, int follow)
MarshallString(&preq, fullPath); MarshallString(&preq, fullPath);
if (blobp->in_size) { if (blobp->in_size) {
if (blobp->in_size > sizeof(preq.data) - (preq.mp - preq.data)*sizeof(char)) {
errno = E2BIG;
return -1;
}
memcpy(preq.mp, blobp->in, blobp->in_size); memcpy(preq.mp, blobp->in, blobp->in_size);
preq.mp += blobp->in_size; preq.mp += blobp->in_size;
} }