commit 48dc0f2c3d87c74c31a27e1d17dabf26c378b1e8
author Laurent Vivier <laurent@vivier.eu> Thu Jun 16 21:01:36 2016 +0200
committer Riku Voipio <riku.voipio@linaro.org> Sun Jun 26 13:17:22 2016 +0300
tree c6d5681cf491bbe9a29a837aa726097ed52c9dbc
parent 84f34b00c8cccfcefbadc45f68036dea957d2153

linux-user: fd_trans_host_to_target_data() must process only received data

if we process the whole buffer, the netlink helpers can try
to swap invalid data.

Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

linux-user/syscall.c

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 33409c0..4b0d791 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2991,7 +2991,7 @@
             len = ret;
             if (fd_trans_host_to_target_data(fd)) {
                 ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base,
-                                                       msg.msg_iov->iov_len);
+                                                       len);
             } else {
                 ret = host_to_target_cmsg(msgp, &msg);
             }