Message ID | 989c10af553dbdb9ec7054c75e4cc5bcde015d3d.1408100160.git.riku.voipio@linaro.org |
---|---|
State | New |
Headers | show |
diff --git a/linux-user/syscall.c b/linux-user/syscall.c index c9a9d3d..d223cff 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -2879,12 +2879,16 @@ struct target_msgbuf { }; static inline abi_long do_msgsnd(int msqid, abi_long msgp, - unsigned int msgsz, int msgflg) + ssize_t msgsz, int msgflg) { struct target_msgbuf *target_mb; struct msgbuf *host_mb; abi_long ret = 0; + if (msgsz < 0) { + return -TARGET_EINVAL; + } + if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0)) return -TARGET_EFAULT; host_mb = malloc(msgsz+sizeof(long));