From dfe158cb2ae1ceb8d46da27fba20c4fea7b95e8b Mon Sep 17 00:00:00 2001
From: glebius <glebius@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Tue, 17 May 2016 22:30:43 +0000
Subject: [PATCH] Validate that user supplied control message length is not
 negative.

Submitted by:	C Turt <cturt hardenedbsd.org>
Security:	SA-16:19
Security:	CVE-2016-1887


git-svn-id: svn://svn.freebsd.org/base/stable/10@300092 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 sys/kern/uipc_syscalls.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index fa36849ac..97ca1156a 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -1787,6 +1787,9 @@ sockargs(mp, buf, buflen, type)
 	struct mbuf *m;
 	int error;
 
+	if (buflen < 0)
+		return (EINVAL);
+
 	if (buflen > MLEN) {
 #ifdef COMPAT_OLDSOCK
 		if (type == MT_SONAME && buflen <= 112)
-- 
2.45.0