svn commit: r300092 - stable/10/sys/kern

[Gleb Smirnoff]

Author: glebius
Date: Tue May 17 22:30:43 2016
New Revision: 300092
URL: https://svnweb.freebsd.org/changeset/base/300092

Log:
  Validate that user supplied control message length is not negative.
  
  Submitted by:	C Turt <cturt hardenedbsd.org>
  Security:	SA-16:19
  Security:	CVE-2016-1887

Modified:
  stable/10/sys/kern/uipc_syscalls.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/kern/uipc_syscalls.c
==============================================================================
--- stable/10/sys/kern/uipc_syscalls.c	Tue May 17 22:29:59 2016	(r300091)
+++ stable/10/sys/kern/uipc_syscalls.c	Tue May 17 22:30:43 2016	(r300092)
@@ -1787,6 +1787,9 @@ sockargs(mp, buf, buflen, type)
 	struct mbuf *m;
 	int error;
 
+	if (buflen < 0)
+		return (EINVAL);
+
 	if (buflen > MLEN) {
 #ifdef COMPAT_OLDSOCK
 		if (type == MT_SONAME && buflen <= 112)