[musl] [PATCH] fix segfault in recvmsg when msg argument is NULL

[musl] [PATCH] fix segfault in recvmsg when msg argument is NULL

[zhuyan (M)]

When msg is NULL, msg->msg_controllen exists to dereference a null pointer in recvmsg.

The commit ae388becb529428ac926da102f1d025b3c3968da introduces this problem

Signed-off-by: Qing Wu <wuqing30@huawei.com>
Signed-off-by: Yan Zhu <zhuyan34@huawei.com>
---
 src/network/recvmsg.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/network/recvmsg.c b/src/network/recvmsg.c index 03641625..c36ffb8d 100644
--- a/src/network/recvmsg.c
+++ b/src/network/recvmsg.c
@@ -4,6 +4,7 @@
 #include <sys/time.h>
 #include <string.h>
 #include "syscall.h"
+#include <errno.h>
 
 hidden void __convert_scm_timestamps(struct msghdr *, socklen_t);
 
@@ -49,6 +50,8 @@ void __convert_scm_timestamps(struct msghdr *msg, socklen_t csize)
 
 ssize_t recvmsg(int fd, struct msghdr *msg, int flags)  {
+	if (!msg) return -EINVAL;
+
 	ssize_t r;
 	socklen_t orig_controllen = msg->msg_controllen;  #if LONG_MAX > INT_MAX
--
2.12.3

[musl] [PATCH] fix segfault in recvmsg when msg argument is NULL

[zhuyan (M)]

When msg is NULL, msg->msg_controllen exists to dereference a null pointer in recvmsg.

The commit ae388becb529428ac926da102f1d025b3c3968da introduces this problem

Signed-off-by: Qing Wu <wuqing30@huawei.com>
Signed-off-by: Yan Zhu <zhuyan34@huawei.com>
---
 src/network/recvmsg.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/network/recvmsg.c b/src/network/recvmsg.c index 03641625..c36ffb8d 100644
--- a/src/network/recvmsg.c
+++ b/src/network/recvmsg.c
@@ -4,6 +4,7 @@
 #include <sys/time.h>
 #include <string.h>
 #include "syscall.h"
+#include <errno.h>
 
 hidden void __convert_scm_timestamps(struct msghdr *, socklen_t);
 
@@ -49,6 +50,8 @@ void __convert_scm_timestamps(struct msghdr *msg, socklen_t csize)
 
 ssize_t recvmsg(int fd, struct msghdr *msg, int flags)  {
+	if (!msg) return -EINVAL;
+
 	ssize_t r;
 	socklen_t orig_controllen = msg->msg_controllen;  #if LONG_MAX > INT_MAX
--
2.12.3

Re: [musl] [PATCH] fix segfault in recvmsg when msg argument is NULL

[Rich Felker]

On Tue, Jan 12, 2021 at 07:58:26AM +0000, zhuyan (M) wrote:
> 
> When msg is NULL, msg->msg_controllen exists to dereference a null pointer in recvmsg.

"The recvmsg() function takes the following arguments:
    ...
    message
        Points to a msghdr structure, ..."
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Re: [musl] [PATCH] fix segfault in recvmsg when msg argument is NULL

[Rich Felker]

On Mon, Jan 25, 2021 at 09:44:25PM -0500, Rich Felker wrote:
> On Tue, Jan 12, 2021 at 07:58:26AM +0000, zhuyan (M) wrote:
> > 
> > When msg is NULL, msg->msg_controllen exists to dereference a null pointer in recvmsg.
> 
> "The recvmsg() function takes the following arguments:
>     ...
>     message
>         Points to a msghdr structure, ..."
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

It was pointed out to me on IRC that there is an "if (msg) condition
later (only on 64-bit archs), which makes this at least inconsistent.
So some cleanup is probably called for.

Also, the patch was incorrect even if you want to avoid crashing. It
returns a negated error code rather than setting errno and returning
-1.

Rich