From 0aa14f832df605b6725b08757be9cb53d75efa26 Mon Sep 17 00:00:00 2001
From: anjiahao <anjiahao@xiaomi.com>
Date: Mon, 12 Jul 2021 22:15:25 +0800
Subject: [PATCH] mq_open: add long file name check and parameter check

Signed-off-by: anjiahao <anjiahao@xiaomi.com>
---
 fs/mqueue/mq_open.c         | 11 ++++++++---
 fs/mqueue/mqueue.h          |  2 +-
 include/nuttx/mqueue.h      | 13 ++++++++++---
 sched/mqueue/mq_msgqalloc.c | 26 +++++++++++++++++++-------
 4 files changed, 38 insertions(+), 14 deletions(-)

diff --git a/fs/mqueue/mq_open.c b/fs/mqueue/mq_open.c
index 2e157809cac..5c288279305 100644
--- a/fs/mqueue/mq_open.c
+++ b/fs/mqueue/mq_open.c
@@ -177,6 +177,12 @@ static int file_mq_vopen(FAR struct file *mq, FAR const char *mq_name,
       goto errout;
     }
 
+  if (strlen(mq_name) > NAME_MAX)
+    {
+      ret = -ENAMETOOLONG;
+      goto errout;
+    }
+
   /* Were we asked to create it? */
 
   if ((oflags & O_CREAT) != 0)
@@ -289,10 +295,9 @@ static int file_mq_vopen(FAR struct file *mq, FAR const char *mq_name,
        * be created with a reference count of zero.
        */
 
-      msgq = (FAR struct mqueue_inode_s *)nxmq_alloc_msgq(attr);
-      if (!msgq)
+      ret = nxmq_alloc_msgq(attr, &msgq);
+      if (ret < 0)
         {
-          ret = -ENOSPC;
           goto errout_with_inode;
         }
 
diff --git a/fs/mqueue/mqueue.h b/fs/mqueue/mqueue.h
index aac018ef50e..aacb6b8f3c1 100644
--- a/fs/mqueue/mqueue.h
+++ b/fs/mqueue/mqueue.h
@@ -39,6 +39,6 @@
 
 /* Sizes of things */
 
-#define MAX_MQUEUE_PATH 64
+#define MAX_MQUEUE_PATH (sizeof(CONFIG_FS_MQUEUE_MPATH) + NAME_MAX)
 
 #endif /* __FS_MQUEUE_MQUEUE_H */
diff --git a/include/nuttx/mqueue.h b/include/nuttx/mqueue.h
index 81d79567004..f834b31ce1c 100644
--- a/include/nuttx/mqueue.h
+++ b/include/nuttx/mqueue.h
@@ -385,14 +385,21 @@ void nxmq_free_msgq(FAR struct mqueue_inode_s *msgq);
  *   attr   - The mq_maxmsg attribute is used at the time that the message
  *            queue is created to determine the maximum number of
  *            messages that may be placed in the message queue.
+ *   pmsgq  - This parameter is a address of a pointer
  *
  * Returned Value:
- *   The allocated and initialized message queue structure or NULL in the
- *   event of a failure.
+ *   Zero (OK) is returned on success. Otherwise, a negated errno value is
+ *   returned to indicate the nature of the failure.
+ *
+ *   EINVAL    attr is NULL or either attr->mq_mqssize or attr->mq_maxmsg
+ *             have an invalid value
+ *   ENOSPC    There is insufficient space for the creation of the new
+ *             message queue
  *
  ****************************************************************************/
 
-FAR struct mqueue_inode_s *nxmq_alloc_msgq(FAR struct mq_attr *attr);
+int nxmq_alloc_msgq(FAR struct mq_attr *attr,
+                    FAR struct mqueue_inode_s **pmsgq);
 
 /****************************************************************************
  * Name: nxmq_pollnotify
diff --git a/sched/mqueue/mq_msgqalloc.c b/sched/mqueue/mq_msgqalloc.c
index 7209f433a9f..fffc153d262 100644
--- a/sched/mqueue/mq_msgqalloc.c
+++ b/sched/mqueue/mq_msgqalloc.c
@@ -49,14 +49,21 @@
  *   attr   - The mq_maxmsg attribute is used at the time that the message
  *            queue is created to determine the maximum number of
  *            messages that may be placed in the message queue.
+ *   pmsgq  - This parameter is a address of a pointer
  *
  * Returned Value:
- *   The allocated and initialized message queue structure or NULL in the
- *   event of a failure.
+ *   Zero (OK) is returned on success. Otherwise, a negated errno value is
+ *   returned to indicate the nature of the failure.
+ *
+ *   EINVAL    attr is NULL or either attr->mq_mqssize or attr->mq_maxmsg
+ *             have an invalid value
+ *   ENOSPC    There is insufficient space for the creation of the new
+ *             message queue
  *
  ****************************************************************************/
 
-FAR struct mqueue_inode_s *nxmq_alloc_msgq(FAR struct mq_attr *attr)
+int nxmq_alloc_msgq(FAR struct mq_attr *attr,
+                    FAR struct mqueue_inode_s **pmsgq)
 {
   FAR struct mqueue_inode_s *msgq;
 
@@ -64,10 +71,10 @@ FAR struct mqueue_inode_s *nxmq_alloc_msgq(FAR struct mq_attr *attr)
    * larger than the configured maximum message size.
    */
 
-  DEBUGASSERT(!attr || attr->mq_msgsize <= MQ_MAX_BYTES);
-  if (attr && attr->mq_msgsize > MQ_MAX_BYTES)
+  DEBUGASSERT((!attr || attr->mq_msgsize <= MQ_MAX_BYTES) && pmsgq);
+  if ((attr && attr->mq_msgsize > MQ_MAX_BYTES) || !pmsgq)
     {
-      return NULL;
+      return -EINVAL;
     }
 
   /* Allocate memory for the new message queue. */
@@ -93,6 +100,11 @@ FAR struct mqueue_inode_s *nxmq_alloc_msgq(FAR struct mq_attr *attr)
 
       msgq->ntpid = INVALID_PROCESS_ID;
     }
+  else
+    {
+      return -ENOSPC;
+    }
 
-  return msgq;
+  *pmsgq = msgq;
+  return OK;
 }