Validate PACKET_RX_RING and PACKET_VERSION socket option value size.

Reported-by: [email protected] Reported-by: [email protected] PiperOrigin-RevId: 723999333
google · Feb 6, 2025 · d8518f2 · d8518f2
1 parent 902a56c
commit d8518f2
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/pkg/sentry/socket/netstack/netstack.go b/pkg/sentry/socket/netstack/netstack.go
@@ -2721,6 +2721,9 @@ func setSockOptPacket(t *kernel.Task, s socket.Socket, ep commonEndpoint, name i
 	switch name {
 	case linux.PACKET_RX_RING:
 		var tpacketReq linux.TpacketReq
+		if len(optVal) < tpacketReq.SizeBytes() {
+			return syserr.ErrInvalidArgument
+		}
 		tpacketReq.UnmarshalBytes(optVal)
 		req := tcpip.TpacketReq{
 			TpBlockSize: tpacketReq.TpBlockSize,
@@ -2751,6 +2754,9 @@ func setSockOptPacket(t *kernel.Task, s socket.Socket, ep commonEndpoint, name i
 		}
 		return nil
 	case linux.PACKET_VERSION:
+		if len(optVal) < sizeOfInt32 {
+			return syserr.ErrInvalidArgument
+		}
 		v := hostarch.ByteOrder.Uint32(optVal)
 		return syserr.TranslateNetstackError(ep.SetSockOptInt(tcpip.PacketMMapVersionOption, int(v)))
 	default: