]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
rtadvd(8): Fix a typo in full msg receive logic
authorcem <cem@FreeBSD.org>
Thu, 12 May 2016 03:37:17 +0000 (03:37 +0000)
committercem <cem@FreeBSD.org>
Thu, 12 May 2016 03:37:17 +0000 (03:37 +0000)
commit201cd226c80fdd60aa722a14d5a6d3f44c3d3eb0
treeb75dccfa63765472b8d0cd132daf457a24db5dba
parente82ec312115b9e788a2e9bb3a02e0ffe4fdd3531
rtadvd(8): Fix a typo in full msg receive logic

Check against the size of the struct, not the pointer.  Previously, a message
with a cm_len between 9 and 23 (inclusive) could cause int msglen to underflow
and read(2) to be invoked with msglen size (implicitly cast to signed),
overrunning the caller-provided buffer.

All users of cm_recv() supply a stack buffer.

On the other hand, the rtadvd control socket appears to only be writable by the
owner, who is probably root.

While here, correct some types to be size_t or ssize_t.

Reported by: Coverity
CID: 1008477
Security: unix socket remotes may overflow stack in rtadvd
Sponsored by: EMC / Isilon Storage Division
usr.sbin/rtadvd/control.c