已合并
socket ioctl中FIONREAD 是旧式 ioctl 命令，未校验用户地址范围 #1424
yang-pangyuan创建于 6月24日
socket ioctl中FIONREAD 是旧式 ioctl 命令，未校验用户地址范围 #1424
已合并
共 1 个文件变更+6-0
| @@ -1633,6 +1633,12 @@ int socks_ioctl(int sockfd, long cmd, void *argp) | |||
| 1633 | int ret; | 1633 | int ret; |
| 1634 | size_t nbytes = 0; | 1634 | size_t nbytes = 0; |
| 1635 | 1635 | ||
| 1636 | + if (cmd == FIONREAD || cmd == FIONBIO) { | ||
| 1637 | + if (!LOS_IsUserAddress((VADDR_T)(uintptr_t)argp)) { | ||
| 1638 | + set_errno(EFAULT); | ||
| 1639 | + ret = -1; | ||
| 1640 | + } | ||
| 1641 | + } | ||
| 1636 | if (LOS_IsUserAddress((VADDR_T)(uintptr_t)argp)) { | 1642 | if (LOS_IsUserAddress((VADDR_T)(uintptr_t)argp)) { |
| 1637 | switch (cmd) { | 1643 | switch (cmd) { |
| 1638 | case FIONREAD: | 1644 | case FIONREAD: |