[Bug libc/13500] New: __cmsg_nxthdr in cmsg_nxthdr.c (CMSG_NXTHDR) has undefined behavior when setting up ancillary data

["igorlord at alum dot mit.edu" <sourceware-bugzilla@sourceware.org>]

http://sourceware.org/bugzilla/show_bug.cgi?id=13500

             Bug #: 13500
           Summary: __cmsg_nxthdr in cmsg_nxthdr.c (CMSG_NXTHDR) has
                    undefined behavior when setting up ancillary data
           Product: glibc
           Version: 2.14
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: igorlord@alum.mit.edu
    Classification: Unclassified


In the current implementation, when setting up ancillary data, __cmsg_nxthdr
will try to read data from the uninitialized area of the ancillary buffer and
may erroneously return NULL.

  cmsg = (struct cmsghdr *) ((unsigned char *) cmsg
                 + CMSG_ALIGN (cmsg->cmsg_len));
  if ((unsigned char *) (cmsg + 1) > ((unsigned char *) mhdr->msg_control
                      + mhdr->msg_controllen)
      || ((unsigned char *) cmsg + CMSG_ALIGN (cmsg->cmsg_len)
      > ((unsigned char *) mhdr->msg_control + mhdr->msg_controllen)))
    /* No more entries.  */
    return NULL;

Above is the relevant part of the current implementation.

"cmsg->cmsg_len" in the second "||" clause will read uninitialized data.  That
second "||" clause is not needed at all (and the kernel version of this
function does not have it).

This implementation is ok for parsing ancillary data (it provides some extra
sanity checking of the data), but it is broken for setting up ancillary data.

A workaround is to memset the entire ancillary data buffer to 0 before
initializing it, but there is no such requirement in neither man pages nor RFC
2292 or RFC 3542.

Glibc's implementation of CMSG_NXTHDR is not consistent with the reference
implementation in RFC 2292 and RFC 3542.



P.S.
  The current implementation does not support another RFC 2292/3542 requirement
requirement:

   The following behavior of this macro is new to this API: if the value
   of the cmsg pointer is NULL, a pointer to the cmsghdr structure
   describing the first ancillary data object is returned.  That is,
   CMSG_NXTHDR(mhdr, NULL) is equivalent to CMSG_FIRSTHDR(mhdr).

But you'll probably want a different bug report for this.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.