Re: 2.2.x BUG & PATCH: recvmsg() does not check msg_controllen correctly

[Philippe Troin <phil@fifi.org>]

[-- Attachment #1: Type: text/plain, Size: 550 bytes --]

"David S. Miller" <davem@redhat.com> writes:

>    From: Philippe Troin <phil@fifi.org>
>    Date: 03 Nov 2000 19:53:04 -0800
> 
>    Yes I agree, mixing signed and unsigned arithmetic is evil... Doesn't
>    gcc have a flag for unsafe signed/unsigned mixtures ?
> 
>    Would you consider this patch (or a variant) for inclusion ?
> 
> I would accept a patch which made the code set fdmax <= 0 when
> (msg->msg_controllen < (sizeof(struct cmsghdr) + sizeof(int)))
> because it is the sole reason this bug exists at all.

How about this one ?

Phil.

[-- Attachment #2: linux-2.2.17-scmrights.patch --]
[-- Type: application/octet-stream, Size: 800 bytes --]

diff -ruN linux.orig/net/core/scm.c linux/net/core/scm.c
--- linux.orig/net/core/scm.c	Thu Apr 22 19:45:19 1999
+++ linux/net/core/scm.c	Sat Nov  4 17:19:34 2000
@@ -210,12 +210,16 @@
 {
 	struct cmsghdr *cm = (struct cmsghdr*)msg->msg_control;
 
-	int fdmax = (msg->msg_controllen - sizeof(struct cmsghdr))/sizeof(int);
+	int fdmax = 0;
 	int fdnum = scm->fp->count;
 	struct file **fp = scm->fp->fp;
 	int *cmfptr;
 	int err = 0, i;
 
+	if (msg->msg_controllen > sizeof(struct cmsghdr))
+		fdmax = (msg->msg_controllen - sizeof(struct cmsghdr))
+			/sizeof(int);
+
 	if (fdnum < fdmax)
 		fdmax = fdnum;
 
@@ -251,7 +255,7 @@
 			msg->msg_controllen -= cmlen;
 		}
 	}
-	if (i < fdnum)
+	if (i < fdnum || (fdnum && fdmax == 0))
 		msg->msg_flags |= MSG_CTRUNC;
 
 	/*