svn commit: r300090 - head/sys/kern

[Gleb Smirnoff]

Author: glebius
Date: Tue May 17 22:28:53 2016
New Revision: 300090
URL: https://svnweb.freebsd.org/changeset/base/300090

Log:
  Validate that user supplied control message length is not negative.
  
  Submitted by:	C Turt <cturt hardenedbsd.org>
  Security:	SA-16:19
  Security:	CVE-2016-1887

Modified:
  head/sys/kern/uipc_syscalls.c

Modified: head/sys/kern/uipc_syscalls.c
==============================================================================
--- head/sys/kern/uipc_syscalls.c	Tue May 17 22:28:42 2016	(r300089)
+++ head/sys/kern/uipc_syscalls.c	Tue May 17 22:28:53 2016	(r300090)
@@ -1699,6 +1699,9 @@ sockargs(mp, buf, buflen, type)
 	struct mbuf *m;
 	int error;
 
+	if (buflen < 0)
+		return (EINVAL);
+
 	if (buflen > MLEN) {
 #ifdef COMPAT_OLDSOCK
 		if (type == MT_SONAME && buflen <= 112)