diff mbox series

[54/66] bsd-user: Validate acl_maxcnt

Message ID 20260515-misc-2026q2-v1-54-5438ca41b27a@bsdimp.com
State New
Headers show
Series bsd-user: Upstream most of the remaining system calls | expand

Commit Message

Warner Losh May 15, 2026, 9:19 p.m. UTC 
Make sure that acl_maxcnt is <= ACL_MAX_ENTRIES.

Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-extattr.c | 9 +++++++++
 1 file changed, 9 insertions(+)
diff mbox series

Patch

diff --git a/bsd-user/freebsd/os-extattr.c b/bsd-user/freebsd/os-extattr.c
index a30d513655..0f0c7123dd 100644
--- a/bsd-user/freebsd/os-extattr.c
+++ b/bsd-user/freebsd/os-extattr.c
@@ -29,6 +29,11 @@  abi_long t2h_freebsd_acl(struct acl *host_acl, abi_ulong target_addr)
     __get_user(host_acl->acl_maxcnt, &target_acl->acl_maxcnt);
     __get_user(host_acl->acl_cnt, &target_acl->acl_cnt);
 
+    if (host_acl->acl_maxcnt > ACL_MAX_ENTRIES) {
+        unlock_user_struct(target_acl, target_addr, 0);
+        return -TARGET_EINVAL;
+    }
+
     for (i = 0; i < host_acl->acl_maxcnt; i++) {
         __get_user(host_acl->acl_entry[i].ae_tag,
             &target_acl->acl_entry[i].ae_tag);
@@ -51,6 +56,10 @@  abi_long h2t_freebsd_acl(abi_ulong target_addr, struct acl *host_acl)
     uint32_t i;
     struct target_freebsd_acl *target_acl;
 
+    if (host_acl->acl_maxcnt > ACL_MAX_ENTRIES) {
+        return -TARGET_EINVAL;
+    }
+
     if (!lock_user_struct(VERIFY_WRITE, target_acl, target_addr, 0)) {
         return -TARGET_EFAULT;
     }