diff options
| author | Nicolas Lacasse <nlacasse@google.com> | 2018-06-29 10:46:49 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-06-29 10:47:38 -0700 |
| commit | 1b5e09f968bf923f5583e8bc7627691b7c62770a (patch) | |
| tree | 26d0b923d9d790912c90674b7275ea2b699b4527 /pkg/sentry/syscalls | |
| parent | f93bd2cbe66817c300114630bb52702466e52129 (diff) | |
aio: Return EINVAL if the number of events is negative.
PiperOrigin-RevId: 202671065
Change-Id: I248b74544d47ddde9cd59d89aa6ccb7dad2b6f89
Diffstat (limited to 'pkg/sentry/syscalls')
| -rw-r--r-- | pkg/sentry/syscalls/linux/sys_aio.go | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/pkg/sentry/syscalls/linux/sys_aio.go b/pkg/sentry/syscalls/linux/sys_aio.go index 470027206..345ef9bec 100644 --- a/pkg/sentry/syscalls/linux/sys_aio.go +++ b/pkg/sentry/syscalls/linux/sys_aio.go @@ -132,7 +132,7 @@ func IoGetevents(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S timespecAddr := args[4].Pointer() // Sanity check arguments. - if minEvents > events { + if minEvents < 0 || minEvents > events { return 0, nil, syserror.EINVAL } @@ -359,6 +359,10 @@ func IoSubmit(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc nrEvents := args[1].Int() addr := args[2].Pointer() + if nrEvents < 0 { + return 0, nil, syserror.EINVAL + } + for i := int32(0); i < nrEvents; i++ { // Copy in the address. cbAddrNative := t.Arch().Native(0) |