size); + ATF_TP_ADD_TC(tp, nvlist_send_recv__overflow_little_endian_size); ATF_TP_ADD_TC(tp, nvlist_send_recv__invalid_fd_size); ATF_TP_ADD_TC(tp, nvlist_send_recv__overflow_fd_size); diff --git a/sys/contrib/libnv/nvlist.c b/sys/contrib/libnv/nvlist.c index 279f31e3a7cc..71fb52d9ee37 100644 --- a/sys/contrib/libnv/nvlist.c +++ b/sys/contrib/libnv/nvlist.c @@ -1028,10 +1028,6 @@ static bool nvlist_check_header(struct nvlist_header *nvlhdrp) { - if (nvlhdrp->nvlh_size > SIZE_MAX - sizeof(*nvlhdrp)) { - ERRNO_SET(EINVAL); - return (false); - } if (nvlhdrp->nvlh_magic != NVLIST_HEADER_MAGIC) { ERRNO_SET(EINVAL); return (false); @@ -1051,6 +1047,11 @@ nvlist_check_header(struct nvlist_header *nvlhdrp) nvlhdrp->nvlh_descriptors = be64toh(nvlhdrp->nvlh_descriptors); } #endif + if (nvlhdrp->nvlh_size > SIZE_MAX - sizeof(*nvlhdrp)) { + ERRNO_SET(EINVAL); + return (false); + } + return (true); }