Message ID | 05a7bdabe45f473c8d1a25d2cd20c1f5@huawei.com |
---|---|
State | New |
Series | "fix segfault in recvmsg when msg argument is NULL" |
Headers | show |
diff --git a/src/network/recvmsg.c b/src/network/recvmsg.c index 03641625..c36ffb8d 100644 --- a/src/network/recvmsg.c +++ b/src/network/recvmsg.c @@ -4,6 +4,7 @@ #include <sys/time.h> #include <string.h> #include "syscall.h" +#include <errno.h> hidden void __convert_scm_timestamps(struct msghdr *, socklen_t); @@ -49,6 +50,8 @@ void __convert_scm_timestamps(struct msghdr *msg, socklen_t csize) ssize_t recvmsg(int fd, struct msghdr *msg, int flags) { + if (!msg) return -EINVAL; + ssize_t r; socklen_t orig_controllen = msg->msg_controllen; #if LONG_MAX > INT_MAX -- 2.12.3
On Tue, Jan 12, 2021 at 07:58:26AM +0000, zhuyan (M) wrote: > > When msg is NULL, msg->msg_controllen exists to dereference a null pointer in recvmsg. "The recvmsg() function takes the following arguments: ... message Points to a msghdr structure, ..." ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
On Mon, Jan 25, 2021 at 09:44:25PM -0500, Rich Felker wrote: > On Tue, Jan 12, 2021 at 07:58:26AM +0000, zhuyan (M) wrote: > > > > When msg is NULL, msg->msg_controllen exists to dereference a null pointer in recvmsg. > > "The recvmsg() function takes the following arguments: > ... > message > Points to a msghdr structure, ..." > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ It was pointed out to me on IRC that there is an "if (msg) condition later (only on 64-bit archs), which makes this at least inconsistent. So some cleanup is probably called for. Also, the patch was incorrect even if you want to avoid crashing. It returns a negated error code rather than setting errno and returning -1. Rich