Page MenuHomeFreeBSD

freebsd32: fix padding of computed control message length for recvmsg()
ClosedPublic

Authored by jah on Mar 30 2019, 11:21 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Dec 21, 4:18 PM
Unknown Object (File)
Nov 12 2024, 9:41 AM
Unknown Object (File)
Oct 30 2024, 5:32 AM
Unknown Object (File)
Oct 30 2024, 5:32 AM
Unknown Object (File)
Oct 30 2024, 5:31 AM
Unknown Object (File)
Oct 30 2024, 5:13 AM
Unknown Object (File)
Oct 6 2024, 6:37 PM
Unknown Object (File)
Sep 24 2024, 10:27 AM
Subscribers

Details

Summary

Each control message region must be aligned on a 4-byte boundary on 32-bit
architectures. The 32-bit compat shim for recvmsg() gets the actual layout
right, but doesn't pad the payload length when computing msg_controllen for
the output message header. If a control message contains an unaligned
payload, such as the 1-byte TTL field in the example attached to PR 236737,
this can produce control message payload boundaries that extend beyond
the boundary reported by msg_controllen.

PR: 236737

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 23410
Build 22426: arc lint + arc unit