Changeset 23068 in vbox for trunk/src/VBox/HostDrivers/VBoxNetAdp/freebsd

Timestamp:

Sep 16, 2009 12:59:18 PM (15 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

52402

Message:

VBoxNetAdp: ioctl cleanup.

File:

• trunk/src/VBox/HostDrivers/VBoxNetAdp/freebsd/VBoxNetAdp-freebsd.c (modified) (3 diffs)

trunk/src/VBox/HostDrivers/VBoxNetAdp/freebsd/VBoxNetAdp-freebsd.c

@@ -121 +121 @@
                 return RTErrConvertToErrno(rc);
             }
-            /* Create dev node */ 
+            /* Create dev node */
             VBoxNetAdpFreeBSDcdev = make_dev(&vboxnetadp_cdevsw, 0,
                 UID_ROOT, GID_WHEEL, 0600, VBOXNETADP_CTL_DEV_NAME);
@@ -149 +149 @@
 VBoxNetAdpFreeBSDCtrlioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags, struct thread *td)
 {
-    PVBOXNETADP pAdp = NULL;
+    PVBOXNETADP pAdp;
     PVBOXNETADPREQ pReq = (PVBOXNETADPREQ)data;
     struct ifnet *ifp;
@@ -157 +157 @@
     {
         case VBOXNETADP_CTL_ADD:
-            if (!(cmd & IOC_OUT))
-                return (EINVAL);
+            if (   !(cmd & IOC_OUT)   /* paranoia*/
+                || IOCPARM_LEN(iCmd) < sizeof(*pReq))
+                return EINVAL;
 
             rc = vboxNetAdpCreate(&pAdp);
             if (RT_FAILURE(rc))
-                return (EINVAL);
-
-            strncpy(pReq->szName, pAdp->szName, sizeof(pReq->szName));
-            break;
+                return EINVAL;
+
+            strncpy(pReq->szName, pAdp->szName, sizeof(pReq->szName) - 1);
+            pReq->szName[sizeof(pReq->szName) - 1] = '\0';
+            break;
+
         case VBOXNETADP_CTL_REMOVE:
+            if (!memchr(pReq->szName, '\0', RT_MIN(sizeof(pReq->szName), IOCPARM_LEN(iCmd))))
+                return EINVAL;
+
             pAdp = vboxNetAdpFindByName(pReq->szName);
-            if (pAdp)
-                rc = vboxNetAdpDestroy(pAdp);
-            else
-                return (EINVAL);
-
-            if (RT_FAILURE(rc))
-                return (EINVAL);
-
-            break;
+            if (!pAdp)
+                return EINVAL;
+
+            rc = vboxNetAdpDestroy(pAdp);
+            if (RT_FAILURE(rc))
+                return EINVAL;
+
+            break;
+
         default:
-            return (EINVAL);
+            return EINVAL;
     }
     return 0;