return -1;
}
+ if (len < atpBDSsize + sizeof(struct atp_set_default) + TOTAL_ATP_HDR_SIZE ||
+ len > atpBDSsize + sizeof(struct atp_set_default) + TOTAL_ATP_HDR_SIZE +
+ ATP_DATA_SIZE) {
+ file_drop(fd);
+ *err = EINVAL;
+ return -1;
+ }
while ((mioc = gbuf_alloc(sizeof(ioc_t), PRI_MED)) == 0) {
struct timespec ts;
/*
* allocate buffer and copy in the response info
*/
+ if (resplen < 0 || resplen > TOTAL_ATP_HDR_SIZE + sizeof(struct atpBDS)*ATP_TRESP_MAX) {
+ file_drop(fd);
+ *err = EINVAL;
+ return -1;
+ }
if ((m = gbuf_alloc_wait(resplen, TRUE)) == 0) {
*err = ENOMEM;
file_drop(fd);
}
for (size = 0, count = 0; count < bds_cnt; count++) {
+ if (UAS_VALUE(bdsp[count].bdsBuffSz) > ATP_DATA_SIZE) {
+ gbuf_freem(m);
+ *err = EINVAL;
+ file_drop(fd);
+ return -1;
+ }
size += UAS_VALUE(bdsp[count].bdsBuffSz);
}
if (size > datalen) {
return -1;
}
+ if (buflen < DDP_X_HDR_SIZE + ATP_HDR_SIZE) {
+ file_drop(fd);
+ *err = EINVAL;
+ return -1;
+ }
+
if ((rcbp = atp->atp_attached.head) != NULL) {
/*
* Got one, move it to the active response Q