From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org
X-Spam-Level: 
X-Spam-Status: No, score=-3.3 required=5.0 tests=MAILING_LIST_MULTI,
	RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL autolearn=ham
	autolearn_force=no version=3.4.4
Received: (qmail 29937 invoked from network); 26 Jan 2021 17:41:55 -0000
Received: from mother.openwall.net (195.42.179.200)
  by inbox.vuxu.org with ESMTPUTF8; 26 Jan 2021 17:41:55 -0000
Received: (qmail 3805 invoked by uid 550); 26 Jan 2021 17:41:49 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
List-ID: <musl.lists.openwall.com>
Reply-To: musl@lists.openwall.com
Received: (qmail 3781 invoked from network); 26 Jan 2021 17:41:49 -0000
Date: Tue, 26 Jan 2021 12:41:36 -0500
From: Rich Felker <dalias@libc.org>
To: "zhuyan (M)" <zhuyan34@huawei.com>
Cc: "musl@lists.openwall.com" <musl@lists.openwall.com>,
	Zengweilin <zengweilin@huawei.com>,
	"liucheng (G)" <liucheng32@huawei.com>,
	"chenzefeng (A)" <chenzefeng2@huawei.com>
Message-ID: <20210126174136.GC23432@brightrain.aerifal.cx>
References: <20210112075724.58561-1-zhuyan34@huawei.com>
 <05a7bdabe45f473c8d1a25d2cd20c1f5@huawei.com>
 <20210126024422.GZ23432@brightrain.aerifal.cx>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210126024422.GZ23432@brightrain.aerifal.cx>
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: Re: [musl] [PATCH] fix segfault in recvmsg when msg argument is NULL

On Mon, Jan 25, 2021 at 09:44:25PM -0500, Rich Felker wrote:
> On Tue, Jan 12, 2021 at 07:58:26AM +0000, zhuyan (M) wrote:
> > 
> > When msg is NULL, msg->msg_controllen exists to dereference a null pointer in recvmsg.
> 
> "The recvmsg() function takes the following arguments:
>     ...
>     message
>         Points to a msghdr structure, ..."
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

It was pointed out to me on IRC that there is an "if (msg) condition
later (only on 64-bit archs), which makes this at least inconsistent.
So some cleanup is probably called for.

Also, the patch was incorrect even if you want to avoid crashing. It
returns a negated error code rather than setting errno and returning
-1.

Rich