From: Riku Voipio <[email protected]> Check array bounds in host_to_target_errno() and target_to_host_errno().
Originally from Timothy Edward Baldwin, checks improved by Riku Cc: Timothy Edward Baldwin <[email protected]> Signed-off-by: Riku Voipio <[email protected]> --- linux-user/syscall.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 06a59b4..100a111 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -614,17 +614,19 @@ static uint16_t host_to_target_errno_table[ERRNO_TABLE_SIZE] = { #endif }; -static inline int host_to_target_errno(int err) +static inline unsigned int host_to_target_errno(unsigned int err) { - if(host_to_target_errno_table[err]) + if(err < ERRNO_TABLE_SIZE && host_to_target_errno_table[err]) { return host_to_target_errno_table[err]; + } return err; } -static inline int target_to_host_errno(int err) +static inline unsigned int target_to_host_errno(unsigned int err) { - if (target_to_host_errno_table[err]) + if (err < ERRNO_TABLE_SIZE && target_to_host_errno_table[err]) { return target_to_host_errno_table[err]; + } return err; } -- 2.6.1
