From: David van Moolenbroek <david@minix3.org>
Date: Sun, 30 Apr 2017 15:33:24 +0000 (+0000)
Subject: Network stack feedback-based fixes
X-Git-Url: http://zhaoyanbai.com/repos/?a=commitdiff_plain;h=79a488aa87e1810dbafce4a8d392cd741cfb4f2f;p=minix.git

Network stack feedback-based fixes

Thanks to Lionel Sambuc!

Change-Id: Iae6b2caf58e2b58093e60c5004cfa477e43da154
---

diff --git a/minix/lib/libsockevent/sockevent.c b/minix/lib/libsockevent/sockevent.c
index bb84cee51..31dbf2574 100644
--- a/minix/lib/libsockevent/sockevent.c
+++ b/minix/lib/libsockevent/sockevent.c
@@ -1375,7 +1375,7 @@ sockevent_listen(sockid_t id, int backlog)
 
 		/*
 		 * For the extremely unlikely case that right after the socket
-		 * is put into listening mode, it has a connection ready tor
+		 * is put into listening mode, it has a connection ready to
 		 * accept, we retest blocked ready-to-read select queries now.
 		 */
 		sockevent_raise(sock, SEV_ACCEPT);
diff --git a/minix/net/uds/io.c b/minix/net/uds/io.c
index 1b8de37b8..37333c296 100644
--- a/minix/net/uds/io.c
+++ b/minix/net/uds/io.c
@@ -10,8 +10,8 @@
  * (SOCK_DGRAM) neither.  There are two types of ancillary data: in-flight file
  * descriptors and sender credentials.  In addition, for SOCK_DGRAM sockets,
  * the segment may contain the sender's socket path (if the sender's socket is
- * bound).  Each segment has has a header, containing the full segment size,
- * the size of the actual data in the segment (if any), and a flags field that
+ * bound).  Each segment has a header, containing the full segment size, the
+ * size of the actual data in the segment (if any), and a flags field that
  * states which ancillary are associated with the segment (if any).  For
  * SOCK_STREAM type sockets, new data may be merged into a previous segment,
  * but only if it has no ancillary data.  For the other two socket types, each
@@ -600,6 +600,14 @@ uds_send_data(struct udssock * uds, struct udssock * peer,
 		    __arraycount(groups))) != OK)
 			return r;
 
+		/*
+		 * getsockcred(3) returns the total number of groups for the
+		 * process, which may exceed the size of the given array.  Our
+		 * groups array should always be large enough for all groups,
+		 * but we check to be sure anyway.
+		 */
+		assert(sockcred.sc_ngroups <= (int)__arraycount(groups));
+
 		credlen = 1 + SOCKCREDSIZE(sockcred.sc_ngroups);
 
 		segflags |= UDS_HAS_CRED;