This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug libc/13500] New: __cmsg_nxthdr in cmsg_nxthdr.c (CMSG_NXTHDR) has undefined behavior when setting up ancillary data
- From: "igorlord at alum dot mit.edu" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sources dot redhat dot com
- Date: Wed, 14 Dec 2011 20:30:08 +0000
- Subject: [Bug libc/13500] New: __cmsg_nxthdr in cmsg_nxthdr.c (CMSG_NXTHDR) has undefined behavior when setting up ancillary data
- Auto-submitted: auto-generated
http://sourceware.org/bugzilla/show_bug.cgi?id=13500
Bug #: 13500
Summary: __cmsg_nxthdr in cmsg_nxthdr.c (CMSG_NXTHDR) has
undefined behavior when setting up ancillary data
Product: glibc
Version: 2.14
Status: NEW
Severity: normal
Priority: P2
Component: libc
AssignedTo: drepper.fsp@gmail.com
ReportedBy: igorlord@alum.mit.edu
Classification: Unclassified
In the current implementation, when setting up ancillary data, __cmsg_nxthdr
will try to read data from the uninitialized area of the ancillary buffer and
may erroneously return NULL.
cmsg = (struct cmsghdr *) ((unsigned char *) cmsg
+ CMSG_ALIGN (cmsg->cmsg_len));
if ((unsigned char *) (cmsg + 1) > ((unsigned char *) mhdr->msg_control
+ mhdr->msg_controllen)
|| ((unsigned char *) cmsg + CMSG_ALIGN (cmsg->cmsg_len)
> ((unsigned char *) mhdr->msg_control + mhdr->msg_controllen)))
/* No more entries. */
return NULL;
Above is the relevant part of the current implementation.
"cmsg->cmsg_len" in the second "||" clause will read uninitialized data. That
second "||" clause is not needed at all (and the kernel version of this
function does not have it).
This implementation is ok for parsing ancillary data (it provides some extra
sanity checking of the data), but it is broken for setting up ancillary data.
A workaround is to memset the entire ancillary data buffer to 0 before
initializing it, but there is no such requirement in neither man pages nor RFC
2292 or RFC 3542.
Glibc's implementation of CMSG_NXTHDR is not consistent with the reference
implementation in RFC 2292 and RFC 3542.
P.S.
The current implementation does not support another RFC 2292/3542 requirement
requirement:
The following behavior of this macro is new to this API: if the value
of the cmsg pointer is NULL, a pointer to the cmsghdr structure
describing the first ancillary data object is returned. That is,
CMSG_NXTHDR(mhdr, NULL) is equivalent to CMSG_FIRSTHDR(mhdr).
But you'll probably want a different bug report for this.
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.