From 8652d8f33a3366829039e90e9b2d0909b1df05a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Axel=20D=C3=B6rfler?= Date: Sun, 31 Dec 2006 15:42:19 +0000 Subject: [PATCH] * return_address() now accepts a NULL address pointer without returning an error. * NET_STACK_GET_COOKIE copied the wrong data, always returned the socket instead of the cookie (which is NULL at this point, anyway). Note that this mechanism is only temporary anyway, as it's highly unsafe. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@19661 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- .../kernel/drivers/network/stack/kernel_stack.cpp | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/add-ons/kernel/drivers/network/stack/kernel_stack.cpp b/src/add-ons/kernel/drivers/network/stack/kernel_stack.cpp index 51d3c07ac9..823dedddb0 100644 --- a/src/add-ons/kernel/drivers/network/stack/kernel_stack.cpp +++ b/src/add-ons/kernel/drivers/network/stack/kernel_stack.cpp @@ -55,8 +55,13 @@ return_address(ArgType &args, void *data) { sockaddr_storage *target; - if (user_memcpy(&target, &((ArgType *)data)->address, sizeof(void *)) < B_OK - || user_memcpy(&((ArgType *)data)->address_length, &args.address_length, sizeof(socklen_t)) < B_OK + if (user_memcpy(&target, &((ArgType *)data)->address, sizeof(void *)) < B_OK) + return B_BAD_ADDRESS; + + if (target == NULL) + return B_OK; + + if (user_memcpy(&((ArgType *)data)->address_length, &args.address_length, sizeof(socklen_t)) < B_OK || user_memcpy(target, args.address, args.address_length) < B_OK) return B_BAD_ADDRESS; @@ -260,7 +265,7 @@ net_stack_control(void *_cookie, uint32 op, void *data, size_t length) // This is needed by accept() call, allowing libnet.so accept() to pass back // in NET_STACK_ACCEPT opcode the cookie (aka the net_stack_cookie!) // of the file descriptor to use for the new accepted socket - return user_memcpy(data, cookie, sizeof(void *)); + return user_memcpy(data, &cookie, sizeof(void *)); case NET_STACK_GET_NEXT_STAT: {