xnu-792.25.20.tar.gz

[apple/xnu.git] / bsd / netat / atp_write.c

diff --git a/bsd/netat/atp_write.c b/bsd/netat/atp_write.c
index ae3c5bb29c8084cabaf0a205c2d56a2d176bf914..3fcbecea4809b0daaa6878d3416f154faf985062 100644 (file)
--- a/bsd/netat/atp_write.c
+++ b/bsd/netat/atp_write.c
@@ -1,31 +1,23 @@
 /*
  * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
  *
- * @APPLE_LICENSE_OSREFERENCE_HEADER_START@
+ * @APPLE_LICENSE_HEADER_START@
  * 
- * This file contains Original Code and/or Modifications of Original Code 
- * as defined in and that are subject to the Apple Public Source License 
- * Version 2.0 (the 'License'). You may not use this file except in 
- * compliance with the License.  The rights granted to you under the 
- * License may not be used to create, or enable the creation or 
- * redistribution of, unlawful or unlicensed copies of an Apple operating 
- * system, or to circumvent, violate, or enable the circumvention or 
- * violation of, any terms of an Apple operating system software license 
- * agreement.
- *
- * Please obtain a copy of the License at 
- * http://www.opensource.apple.com/apsl/ and read it before using this 
- * file.
- *
- * The Original Code and all software distributed under the License are 
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 
- * Please see the License for the specific language governing rights and 
- * limitations under the License.
- *
- * @APPLE_LICENSE_OSREFERENCE_HEADER_END@
+ * The contents of this file constitute Original Code as defined in and
+ * are subject to the Apple Public Source License Version 1.1 (the
+ * "License").  You may not use this file except in compliance with the
+ * License.  Please obtain a copy of the License at
+ * http://www.apple.com/publicsource and read it before using this file.
+ * 
+ * This Original Code and all software distributed under the License are
+ * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
+ * License for the specific language governing rights and limitations
+ * under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
  */
 /*
  *     Copyright (c) 1996-1998 Apple Computer, Inc.
@@ -1416,6 +1408,13 @@ _ATPsndreq(fd, buf, len, nowait, err, proc)
                return -1;
        }
 
+       if (len < atpBDSsize + sizeof(struct atp_set_default) + TOTAL_ATP_HDR_SIZE ||
+               len > atpBDSsize + sizeof(struct atp_set_default) + TOTAL_ATP_HDR_SIZE + 
+               ATP_DATA_SIZE) {
+               file_drop(fd);
+               *err = EINVAL;
+               return -1;
+       }
 
        while ((mioc = gbuf_alloc(sizeof(ioc_t), PRI_MED)) == 0) {
                struct timespec ts;
@@ -1646,6 +1645,11 @@ _ATPsndrsp(fd, respbuff, resplen, datalen, err, proc)
        /*
         * allocate buffer and copy in the response info
         */
+       if (resplen < 0 || resplen > TOTAL_ATP_HDR_SIZE + sizeof(struct atpBDS)*ATP_TRESP_MAX) {
+               file_drop(fd);
+               *err = EINVAL;
+               return -1;
+       }
        if ((m = gbuf_alloc_wait(resplen, TRUE)) == 0) {
                *err = ENOMEM;
                file_drop(fd);
@@ -1675,6 +1679,12 @@ _ATPsndrsp(fd, respbuff, resplen, datalen, err, proc)
        }
        
        for (size = 0, count = 0; count < bds_cnt; count++) {
+               if (UAS_VALUE(bdsp[count].bdsBuffSz) > ATP_DATA_SIZE) {
+                       gbuf_freem(m);
+                       *err = EINVAL;
+                       file_drop(fd);
+                       return -1;
+               }
                size += UAS_VALUE(bdsp[count].bdsBuffSz);
        }
        if (size > datalen) {                           
@@ -1759,6 +1769,12 @@ _ATPgetreq(fd, buf, buflen, err, proc)
                return -1;
        }
 
+       if (buflen < DDP_X_HDR_SIZE + ATP_HDR_SIZE) {
+               file_drop(fd);
+               *err = EINVAL;
+               return -1;
+       }
+
        if ((rcbp = atp->atp_attached.head) != NULL) {
            /*
             * Got one, move it to the active response Q