提交 8310a32c 编写于 作者: D David S. Miller

[SPARC]: Fix length parameter verification in sys_getdomainname().

Found by scrashme.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 8a84eb16
...@@ -465,21 +465,21 @@ sys_rt_sigaction(int sig, ...@@ -465,21 +465,21 @@ sys_rt_sigaction(int sig,
asmlinkage int sys_getdomainname(char __user *name, int len) asmlinkage int sys_getdomainname(char __user *name, int len)
{ {
int nlen; int nlen, err;
int err = -EFAULT;
if (len < 0 || len > __NEW_UTS_LEN)
return -EINVAL;
down_read(&uts_sem); down_read(&uts_sem);
nlen = strlen(system_utsname.domainname) + 1; nlen = strlen(system_utsname.domainname) + 1;
if (nlen < len) if (nlen < len)
len = nlen; len = nlen;
if (len > __NEW_UTS_LEN)
goto done; err = -EFAULT;
if (copy_to_user(name, system_utsname.domainname, len)) if (!copy_to_user(name, system_utsname.domainname, len))
goto done; err = 0;
err = 0;
done:
up_read(&uts_sem); up_read(&uts_sem);
return err; return err;
} }
...@@ -701,21 +701,21 @@ extern void check_pending(int signum); ...@@ -701,21 +701,21 @@ extern void check_pending(int signum);
asmlinkage long sys_getdomainname(char __user *name, int len) asmlinkage long sys_getdomainname(char __user *name, int len)
{ {
int nlen; int nlen, err;
int err = -EFAULT;
if (len < 0 || len > __NEW_UTS_LEN)
return -EINVAL;
down_read(&uts_sem); down_read(&uts_sem);
nlen = strlen(system_utsname.domainname) + 1; nlen = strlen(system_utsname.domainname) + 1;
if (nlen < len) if (nlen < len)
len = nlen; len = nlen;
if (len > __NEW_UTS_LEN)
goto done; err = -EFAULT;
if (copy_to_user(name, system_utsname.domainname, len)) if (!copy_to_user(name, system_utsname.domainname, len))
goto done; err = 0;
err = 0;
done:
up_read(&uts_sem); up_read(&uts_sem);
return err; return err;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册