From 1b5e09f968bf923f5583e8bc7627691b7c62770a Mon Sep 17 00:00:00 2001 From: Nicolas Lacasse Date: Fri, 29 Jun 2018 10:46:49 -0700 Subject: aio: Return EINVAL if the number of events is negative. PiperOrigin-RevId: 202671065 Change-Id: I248b74544d47ddde9cd59d89aa6ccb7dad2b6f89 --- pkg/sentry/syscalls/linux/sys_aio.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'pkg') diff --git a/pkg/sentry/syscalls/linux/sys_aio.go b/pkg/sentry/syscalls/linux/sys_aio.go index 470027206..345ef9bec 100644 --- a/pkg/sentry/syscalls/linux/sys_aio.go +++ b/pkg/sentry/syscalls/linux/sys_aio.go @@ -132,7 +132,7 @@ func IoGetevents(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S timespecAddr := args[4].Pointer() // Sanity check arguments. - if minEvents > events { + if minEvents < 0 || minEvents > events { return 0, nil, syserror.EINVAL } @@ -359,6 +359,10 @@ func IoSubmit(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc nrEvents := args[1].Int() addr := args[2].Pointer() + if nrEvents < 0 { + return 0, nil, syserror.EINVAL + } + for i := int32(0); i < nrEvents; i++ { // Copy in the address. cbAddrNative := t.Arch().Native(0) -- cgit v1.2.3