improve the input validation of parse_readv_writev_bufs()to better pr…

…otect from buffer overflows
falcosecurity · Aug 6, 2019 · 55b1cc8 · 55b1cc8
1 parent 92622e3
commit 55b1cc8
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/driver/ppm_events.c b/driver/ppm_events.c
@@ -1112,7 +1112,7 @@ int32_t parse_readv_writev_bufs(struct event_filler_arguments *args, const struc
 {
 	int32_t res;
 	const struct iovec *iov;
-	u32 copylen;
+	u64 copylen;
 	u32 j;
 	u64 size = 0;
 	unsigned long bufsize;
@@ -1125,6 +1125,9 @@ int32_t parse_readv_writev_bufs(struct event_filler_arguments *args, const struc
 
 	copylen = iovcnt * sizeof(struct iovec);
 
+	if (unlikely(iovcnt >= 0xffffffff))
+		return PPM_FAILURE_BUFFER_FULL;
+
 	if (unlikely(copylen >= STR_STORAGE_SIZE))
 		return PPM_FAILURE_BUFFER_FULL;
 
@@ -1245,7 +1248,7 @@ int32_t compat_parse_readv_writev_bufs(struct event_filler_arguments *args, cons
 {
 	int32_t res;
 	const struct compat_iovec *iov;
-	u32 copylen;
+	u64 copylen;
 	u32 j;
 	u64 size = 0;
 	unsigned long bufsize;
@@ -1258,6 +1261,9 @@ int32_t compat_parse_readv_writev_bufs(struct event_filler_arguments *args, cons
 
 	copylen = iovcnt * sizeof(struct compat_iovec);
 
+	if (unlikely(iovcnt >= 0xffffffff))
+		return PPM_FAILURE_BUFFER_FULL;
+
 	if (unlikely(copylen >= STR_STORAGE_SIZE))
 		return PPM_FAILURE_BUFFER_FULL;