(nuttx) branch master updated: net/inet: Fail sendmsg() when the sum of the iov_len values overflows.

[xiaoxiang.apache.org via commits]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 3671f941691 net/inet: Fail sendmsg() when the sum of the iov_len 
values overflows.
3671f941691 is described below

commit 3671f941691e8e8fd258956aa99e8c88189ad9d1
Author: Marco Casaroli <marco.casar...@gmail.com>
AuthorDate: Sun Nov 1 20:29:15 2026 +0100

    net/inet: Fail sendmsg() when the sum of the iov_len values overflows.
    
    With more than one iovec, inet_sendmsg() adds the iov_len values in a
    size_t, allocates a buffer of that size and copies every iovec into it.
    The sum is not checked: when it wraps, the buffer is too small and the
    copy writes past its end.
    
    Fail with EINVAL when the sum does not fit in an ssize_t, as POSIX
    specifies for sendmsg() and as uio_calc_resid() does for readv() and
    writev().
    
    Assisted-by: Claude Code:claude-opus-5-5
    Signed-off-by: Marco Casaroli <marco.casar...@gmail.com>
---
 net/inet/inet_sockif.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/inet/inet_sockif.c b/net/inet/inet_sockif.c
index 4869e55cdc6..1099a2246c6 100644
--- a/net/inet/inet_sockif.c
+++ b/net/inet/inet_sockif.c
@@ -31,6 +31,7 @@
 #include <stdbool.h>
 #include <assert.h>
 #include <errno.h>
+#include <limits.h>
 #include <nuttx/debug.h>
 
 #include <nuttx/net/net.h>
@@ -1856,6 +1857,14 @@ static ssize_t inet_sendmsg(FAR struct socket *psock,
   end = &msg->msg_iov[msg->msg_iovlen];
   for (len = 0, iov = msg->msg_iov; iov != end; iov++)
     {
+      /* The sum of the iov_len values must fit in an ssize_t */
+
+      if (iov->iov_len > SSIZE_MAX - len)
+        {
+          nwarn("WARNING: The sum of the iov_len values is too large\n");
+          return -EINVAL;
+        }
+
       len += iov->iov_len;
     }