X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/ff6e181ae92fc6f1e89841290f461d1f2f9badd9..8f6c56a50524aa785f7e596d52dddfb331e18961:/bsd/netat/atp_write.c

diff --git a/bsd/netat/atp_write.c b/bsd/netat/atp_write.c
index b593f883d..34d18be4b 100644
--- a/bsd/netat/atp_write.c
+++ b/bsd/netat/atp_write.c
@@ -1,14 +1,19 @@
 /*
  * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
  *
- * @APPLE_LICENSE_HEADER_START@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
+ * 
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
  * 
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
@@ -18,7 +23,7 @@
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * 
- * @APPLE_LICENSE_HEADER_END@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 /*
  *	Copyright (c) 1996-1998 Apple Computer, Inc.
@@ -1467,6 +1472,13 @@ _ATPsndreq(fd, buf, len, nowait, err, proc)
 		return -1;
 	}
 
+	if (len < atpBDSsize + sizeof(struct atp_set_default) + TOTAL_ATP_HDR_SIZE ||
+		len > atpBDSsize + sizeof(struct atp_set_default) + TOTAL_ATP_HDR_SIZE + 
+		ATP_DATA_SIZE) {
+		file_drop(fd);
+		*err = EINVAL;
+		return -1;
+	}
 
 	while ((mioc = gbuf_alloc(sizeof(ioc_t), PRI_MED)) == 0) {
 		struct timespec ts;
@@ -1708,6 +1720,11 @@ _ATPsndrsp(fd, respbuff, resplen, datalen, err, proc)
 	/*
 	 * allocate buffer and copy in the response info
 	 */
+	if (resplen < 0 || resplen > TOTAL_ATP_HDR_SIZE + sizeof(struct atpBDS)*ATP_TRESP_MAX) {
+		file_drop(fd);
+		*err = EINVAL;
+		return -1;
+	}
 	if ((m = gbuf_alloc_wait(resplen, TRUE)) == 0) {
 	        *err = ENOMEM;
 		file_drop(fd);
@@ -1737,6 +1754,12 @@ _ATPsndrsp(fd, respbuff, resplen, datalen, err, proc)
 	}
 	
 	for (size = 0, count = 0; count < bds_cnt; count++) {
+		if (UAS_VALUE(bdsp[count].bdsBuffSz) > ATP_DATA_SIZE) {
+			gbuf_freem(m);
+			*err = EINVAL;
+			file_drop(fd);
+			return -1;
+		}
 		size += UAS_VALUE(bdsp[count].bdsBuffSz);
 	}
 	if (size > datalen) {				
@@ -1821,6 +1844,12 @@ _ATPgetreq(fd, buf, buflen, err, proc)
 		return -1;
 	}
 
+	if (buflen < DDP_X_HDR_SIZE + ATP_HDR_SIZE) {
+		file_drop(fd);
+		*err = EINVAL;
+		return -1;
+	}
+
 	ATDISABLE(s, atp->atp_lock);
 	if ((rcbp = atp->atp_attached.head) != NULL) {
 	    /*