From 84c33ccbbe045d3b074d63504b4d5fad4dc253e6 Mon Sep 17 00:00:00 2001 From: Ulrich Drepper Date: Sun, 6 Mar 2005 21:25:22 +0000 Subject: [PATCH] * debug/recv_chk.c (__recv_chk): Always fail if request could overflow the buffer. * debug/recvfrom_chk.c (__recvfrom_chk): Likewise. --- ChangeLog | 3 +++ debug/recv_chk.c | 9 +++------ debug/recvfrom_chk.c | 10 +++------- 3 files changed, 9 insertions(+), 13 deletions(-) diff --git a/ChangeLog b/ChangeLog index f94c643..5492771 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,8 @@ 2005-03-06 Ulrich Drepper + * debug/recv_chk.c (__recv_chk): Always fail if request could + overflow the buffer. + * debug/recvfrom_chk.c (__recvfrom_chk): Likewise. * socket/bits/socket2.h (recv): Avoid calls to the _chk variant if we know the call succeeds. (recvfrom): Likewise. diff --git a/debug/recv_chk.c b/debug/recv_chk.c index 7a49d17..479ebdf 100644 --- a/debug/recv_chk.c +++ b/debug/recv_chk.c @@ -23,11 +23,8 @@ ssize_t __recv_chk (int fd, void *buf, size_t n, size_t buflen, int flags) { - /* In case N is greater than BUFLEN, we read BUFLEN+1 bytes. - This might overflow the buffer but the damage is reduced to just - one byte. And the program will terminate right away. */ - ssize_t nrecv = __recv (fd, buf, MIN (n, buflen + 1), flags); - if (nrecv > 0 && (size_t) nrecv > buflen) + if (n > buflen) __chk_fail (); - return nrecv; + + return __recv (fd, buf, n, flags); } diff --git a/debug/recvfrom_chk.c b/debug/recvfrom_chk.c index e1b1da7..9790a15 100644 --- a/debug/recvfrom_chk.c +++ b/debug/recvfrom_chk.c @@ -24,12 +24,8 @@ ssize_t __recvfrom_chk (int fd, void *buf, size_t n, size_t buflen, int flags, __SOCKADDR_ARG addr, socklen_t *addr_len) { - /* In case N is greater than BUFLEN, we read BUFLEN+1 bytes. - This might overflow the buffer but the damage is reduced to just - one byte. And the program will terminate right away. */ - ssize_t nrecv = __recvfrom (fd, buf, MIN (n, buflen + 1), flags, - addr, addr_len); - if (nrecv > 0 && (size_t) nrecv > buflen) + if (n > buflen) __chk_fail (); - return nrecv; + + return __recvfrom (fd, buf, n, flags, addr, addr_len); } -- 2.7.4