From patchwork Fri Feb 8 17:58:41 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 219240 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 080BF2C0089 for ; Sat, 9 Feb 2013 05:03:55 +1100 (EST) Received: from localhost ([::1]:46087 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U3sIj-0005R5-NI for incoming@patchwork.ozlabs.org; Fri, 08 Feb 2013 13:03:53 -0500 Received: from eggs.gnu.org ([208.118.235.92]:60739) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U3sFX-00055X-JZ for qemu-devel@nongnu.org; Fri, 08 Feb 2013 13:03:46 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1U3sDk-0001G7-51 for qemu-devel@nongnu.org; Fri, 08 Feb 2013 13:00:35 -0500 Received: from 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.d.1.0.0.b.8.0.1.0.0.2.ip6.arpa ([2001:8b0:1d0::1]:60311 helo=mnementh.archaic.org.uk) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U3sDj-0001G3-UR for qemu-devel@nongnu.org; Fri, 08 Feb 2013 12:58:44 -0500 Received: from pm215 by mnementh.archaic.org.uk with local (Exim 4.72) (envelope-from ) id 1U3sDh-0000fr-Tp; Fri, 08 Feb 2013 17:58:41 +0000 From: Peter Maydell To: qemu-devel@nongnu.org Date: Fri, 8 Feb 2013 17:58:41 +0000 Message-Id: <1360346321-2568-1-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 1.7.2.5 X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2001:8b0:1d0::1 Cc: Riku Voipio , patches@linaro.org Subject: [Qemu-devel] [PATCH] linux-user: make bogus negative iovec lengths fail EINVAL X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org If the guest passes us a bogus negative length for an iovec, fail EINVAL rather than proceeding blindly forward. This fixes some of the error cases tests for readv and writev in the LTP. Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson --- I guess I'll resend this mixed bag of linux-user patches as a single series after the trunk reopens; feel free to review in the meantime :-) linux-user/syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 35df073..d38eb24 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -1779,7 +1779,7 @@ static struct iovec *lock_iovec(int type, abi_ulong target_addr, errno = 0; return NULL; } - if (count > IOV_MAX) { + if (count < 0 || count > IOV_MAX) { errno = EINVAL; return NULL; }