From ea46d8040378e078738be1d5fcdecca91a3a2c97 Mon Sep 17 00:00:00 2001
From: Swatantra Yadav <maverickswatantra@gmail.com>
Date: Wed, 4 Nov 2026 04:34:51 +0530
Subject: [PATCH] net/usrsock: fail sendmsg when the sum of iov_len overflows

With more than one iovec, usrsock_sendmsg() adds the iov_len values
into req.buflen. If the sum overflows, it silently wraps around, and
the subsequent check (req.buflen > UINT32_MAX) was dead code because
req.buflen is a uint32_t.

Fail with -EINVAL when the sum of iov_len values exceeds
MIN(SSIZE_MAX, UINT32_MAX). This enforces the POSIX IEEE Std 1003.1
limit (SSIZE_MAX) on 32-bit platforms and prevents 32-bit wrap-around
of req.buflen (UINT32_MAX) on 64-bit platforms.

Signed-off-by: Swatantra Yadav <maverickswatantra@gmail.com>
Assisted-by: Google Gemini
---
 net/usrsock/usrsock_sendmsg.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/net/usrsock/usrsock_sendmsg.c b/net/usrsock/usrsock_sendmsg.c
index 5530c0eb8d0bb..182a99d594a08 100644
--- a/net/usrsock/usrsock_sendmsg.c
+++ b/net/usrsock/usrsock_sendmsg.c
@@ -27,14 +27,16 @@
 #include <nuttx/config.h>
 #if defined(CONFIG_NET) && defined(CONFIG_NET_USRSOCK)
 
-#include <stdint.h>
-#include <string.h>
 #include <assert.h>
 #include <errno.h>
+#include <limits.h>
+#include <stdint.h>
+#include <string.h>
 #include <nuttx/debug.h>
 
 #include <arch/irq.h>
 
+#include <sys/param.h>
 #include <sys/socket.h>
 #include <nuttx/net/net.h>
 #include <nuttx/net/usrsock.h>
@@ -160,12 +162,16 @@ static int do_sendto_request(FAR struct usrsock_conn_s *conn,
 
   for (i = 0; i < msg->msg_iovlen; i++)
     {
-      req.buflen += msg->msg_iov[i].iov_len;
-    }
+      /* The sum of the iov_len values must fit in ssize_t and uint32_t */
 
-  if (req.buflen > UINT32_MAX)
-    {
-      req.buflen = UINT32_MAX;
+      if (msg->msg_iov[i].iov_len >
+          MIN(SSIZE_MAX, UINT32_MAX) - req.buflen)
+        {
+          nwarn("WARNING: The sum of the iov_len values is too large\n");
+          return -EINVAL;
+        }
+
+      req.buflen += msg->msg_iov[i].iov_len;
     }
 
   bufs[0].iov_base = (FAR void *)&req;
@@ -364,7 +370,7 @@ ssize_t usrsock_sendmsg(FAR struct socket *psock,
 
       /* MSG_DONTWAIT is only use in usrsock. */
 
-       flags &= ~MSG_DONTWAIT;
+      flags &= ~MSG_DONTWAIT;
 
       /* Request user-space daemon to close socket. */