This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new 6e1126a2362 net/usrsock: fail sendmsg when the sum of iov_len overflows
6e1126a2362 is described below
commit 6e1126a2362e3523393804ac9e369264b609f6cd
Author: Swatantra Yadav <[email protected]>
AuthorDate: Wed Nov 4 04:34:51 2026 +0530
net/usrsock: fail sendmsg when the sum of iov_len overflows
With more than one iovec, usrsock_sendmsg() adds the iov_len values
into req.buflen. If the sum overflows, it silently wraps around, and
the subsequent check (req.buflen > UINT32_MAX) was dead code because
req.buflen is a uint32_t.
Fail with -EINVAL when the sum of iov_len values exceeds
MIN(SSIZE_MAX, UINT32_MAX). This enforces the POSIX IEEE Std 1003.1
limit (SSIZE_MAX) on 32-bit platforms and prevents 32-bit wrap-around
of req.buflen (UINT32_MAX) on 64-bit platforms.
Signed-off-by: Swatantra Yadav <[email protected]>
Assisted-by: Google Gemini
---
net/usrsock/usrsock_sendmsg.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/net/usrsock/usrsock_sendmsg.c b/net/usrsock/usrsock_sendmsg.c
index 5530c0eb8d0..182a99d594a 100644
--- a/net/usrsock/usrsock_sendmsg.c
+++ b/net/usrsock/usrsock_sendmsg.c
@@ -27,14 +27,16 @@
#include <nuttx/config.h>
#if defined(CONFIG_NET) && defined(CONFIG_NET_USRSOCK)
-#include <stdint.h>
-#include <string.h>
#include <assert.h>
#include <errno.h>
+#include <limits.h>
+#include <stdint.h>
+#include <string.h>
#include <nuttx/debug.h>
#include <arch/irq.h>
+#include <sys/param.h>
#include <sys/socket.h>
#include <nuttx/net/net.h>
#include <nuttx/net/usrsock.h>
@@ -160,12 +162,16 @@ static int do_sendto_request(FAR struct usrsock_conn_s
*conn,
for (i = 0; i < msg->msg_iovlen; i++)
{
- req.buflen += msg->msg_iov[i].iov_len;
- }
+ /* The sum of the iov_len values must fit in ssize_t and uint32_t */
- if (req.buflen > UINT32_MAX)
- {
- req.buflen = UINT32_MAX;
+ if (msg->msg_iov[i].iov_len >
+ MIN(SSIZE_MAX, UINT32_MAX) - req.buflen)
+ {
+ nwarn("WARNING: The sum of the iov_len values is too large\n");
+ return -EINVAL;
+ }
+
+ req.buflen += msg->msg_iov[i].iov_len;
}
bufs[0].iov_base = (FAR void *)&req;
@@ -364,7 +370,7 @@ ssize_t usrsock_sendmsg(FAR struct socket *psock,
/* MSG_DONTWAIT is only use in usrsock. */
- flags &= ~MSG_DONTWAIT;
+ flags &= ~MSG_DONTWAIT;
/* Request user-space daemon to close socket. */
