From 6e5d779ecb9acd034f90af1de8f9416832d663d0 Mon Sep 17 00:00:00 2001 From: Anatoly Burakov Date: Mon, 29 Apr 2019 14:59:28 +0100 Subject: [PATCH] ipc: handle more invalid parameter cases Length of buffer and number of fd's to send are signed values, so they can be negative, but the API doesn't check for that. Fix it by checking for negative values as well. Fixes: bacaa2754017 ("eal: add channel for multi-process communication") Cc: stable@dpdk.org Signed-off-by: Anatoly Burakov --- lib/librte_eal/common/eal_common_proc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/lib/librte_eal/common/eal_common_proc.c b/lib/librte_eal/common/eal_common_proc.c index 6ffd476861..d098803b11 100644 --- a/lib/librte_eal/common/eal_common_proc.c +++ b/lib/librte_eal/common/eal_common_proc.c @@ -761,6 +761,18 @@ check_input(const struct rte_mp_msg *msg) if (validate_action_name(msg->name)) return false; + if (msg->len_param < 0) { + RTE_LOG(ERR, EAL, "Message data length is negative\n"); + rte_errno = EINVAL; + return false; + } + + if (msg->num_fds < 0) { + RTE_LOG(ERR, EAL, "Number of fd's is negative\n"); + rte_errno = EINVAL; + return false; + } + if (msg->len_param > RTE_MP_MAX_PARAM_LEN) { RTE_LOG(ERR, EAL, "Message data is too long\n"); rte_errno = E2BIG; -- 2.20.1