getservbyport_r: fix out-of-bounds buffer read

[musl] / src / ipc / semctl.c

diff --git a/src/ipc/semctl.c b/src/ipc/semctl.c
index 941e281..bbb97d7 100644 (file)
--- a/src/ipc/semctl.c
+++ b/src/ipc/semctl.c
@@ -18,13 +18,24 @@ int semctl(int id, int num, int cmd, ...)
 {
        union semun arg = {0};
        va_list ap;
-       switch (cmd) {
-       case SETVAL: case GETALL: case SETALL: case IPC_STAT: case IPC_SET:
-       case IPC_INFO: case SEM_INFO: case SEM_STAT:
+       switch (cmd & ~IPC_TIME64) {
+       case SETVAL: case GETALL: case SETALL: case IPC_SET:
+       case IPC_INFO: case SEM_INFO:
+       case IPC_STAT & ~IPC_TIME64:
+       case SEM_STAT & ~IPC_TIME64:
+       case SEM_STAT_ANY & ~IPC_TIME64:
                va_start(ap, cmd);
                arg = va_arg(ap, union semun);
                va_end(ap);
        }
+#if IPC_TIME64
+       struct semid_ds out, *orig;
+       if (cmd&IPC_TIME64) {
+               out = (struct semid_ds){0};
+               orig = arg.buf;
+               arg.buf = &out;
+       }
+#endif
 #ifdef SYSCALL_IPC_BROKEN_MODE
        struct semid_ds tmp;
        if (cmd == IPC_SET) {
@@ -33,18 +44,26 @@ int semctl(int id, int num, int cmd, ...)
                arg.buf = &tmp;
        }
 #endif
-#ifdef SYS_semctl
-       int r = __syscall(SYS_semctl, id, num, cmd | IPC_64, arg.buf);
+#ifndef SYS_ipc
+       int r = __syscall(SYS_semctl, id, num, IPC_CMD(cmd), arg.buf);
 #else
-       int r = __syscall(SYS_ipc, IPCOP_semctl, id, num, cmd | IPC_64, &arg.buf);
+       int r = __syscall(SYS_ipc, IPCOP_semctl, id, num, IPC_CMD(cmd), &arg.buf);
 #endif
 #ifdef SYSCALL_IPC_BROKEN_MODE
-       if (r >= 0) switch (cmd) {
+       if (r >= 0) switch (cmd | IPC_TIME64) {
        case IPC_STAT:
        case SEM_STAT:
        case SEM_STAT_ANY:
                arg.buf->sem_perm.mode >>= 16;
        }
+#endif
+#if IPC_TIME64
+       if (r >= 0 && (cmd&IPC_TIME64)) {
+               arg.buf = orig;
+               *arg.buf = out;
+               IPC_HILO(arg.buf, sem_otime);
+               IPC_HILO(arg.buf, sem_ctime);
+       }
 #endif
        return __syscall_ret(r);
 }