From a620bd7935c4b2dc94e472e62bd9a5c9434ea7b7 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Thu, 27 Jun 2019 15:08:40 +0200
Subject: Linux: Adjust gedents64 buffer size to int range [BZ #24740]

The kernel interface uses type unsigned int, but there is an
internal conversion to int, so INT_MAX is the correct limit.
Part of the buffer will always be unused, but this is not a
problem.  Such huge buffers do not occur in practice anyway.

Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
---
 sysdeps/unix/sysv/linux/mips/mips64/getdents64.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'sysdeps/unix/sysv/linux/mips/mips64/getdents64.c')

diff --git a/sysdeps/unix/sysv/linux/mips/mips64/getdents64.c b/sysdeps/unix/sysv/linux/mips/mips64/getdents64.c
index 1e22fa4325..8bf3abb0e0 100644
--- a/sysdeps/unix/sysv/linux/mips/mips64/getdents64.c
+++ b/sysdeps/unix/sysv/linux/mips/mips64/getdents64.c
@@ -23,12 +23,18 @@
 #include <sys/param.h>
 #include <unistd.h>
 #include <scratch_buffer.h>
+#include <limits.h>
 
 ssize_t
 __getdents64 (int fd, void *buf0, size_t nbytes)
 {
   char *buf = buf0;
 
+  /* The system call takes an unsigned int argument, and some length
+     checks in the kernel use an int type.  */
+  if (nbytes > INT_MAX)
+    nbytes = INT_MAX;
+
 #ifdef __NR_getdents64
   ssize_t ret = INLINE_SYSCALL_CALL (getdents64, fd, buf, nbytes);
   if (ret != -1)
-- 
cgit 1.4.1