sergiotarxz/nuttx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

local_sendmsg: fix peer->lc_cfps[] array out-of-range write

Browse Source 
When peer->lc_cfpcount == LOCAL_NCONTROLFDS,
Line 122: peer->lc_cfps[peer->lc_cfpcount++] = filep2; access
out-of-range

Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
This commit is contained in:
Bowen Wang 2023-10-12 14:50:17 +08:00 committed by Xiang Xiao
parent ce16288494
commit 7a9aa9539c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/local/local_sendmsg.c
View File

@ -91,7 +91,7 @@ static int local_sendctl(FAR struct local_conn_s *conn,
fds = (int *)CMSG_DATA(cmsg); fds = (int *)CMSG_DATA(cmsg);
count = (cmsg->cmsg_len - sizeof(struct cmsghdr)) / sizeof(int); count = (cmsg->cmsg_len - sizeof(struct cmsghdr)) / sizeof(int);
if (count + peer->lc_cfpcount > LOCAL_NCONTROLFDS) if (count + peer->lc_cfpcount >= LOCAL_NCONTROLFDS)
{ {
ret = -EMFILE; ret = -EMFILE;
goto fail; goto fail;