| Summary: | CMSG_NXTHDR use uninitialized variable | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | flypig.zhu | ||||
| Component: | glibc | Assignee: | glibc team <glibc-bugzilla> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | qe-baseos-tools-bugs | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.2 | CC: | ashankar, codonell, flypig.zhu, fweimer, mnewsome, pfrankli | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-06-20 02:26:38 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Attachments: |
|
||||||
*** Bug 1402300 has been marked as a duplicate of this bug. *** This is likely a bug in application code. We need a minimal test case which shows the problem. Created attachment 1228950 [details]
testcase
The test case needs an optimization barrier. The current version of CMSG_NXTHDR provided glibc is unsuitable for constructing a list of ancillary data because of the length check against the *next* cmsg_len header, which is indeed uninitialized at this point. It is not clear if this is a bug. We need to raise this upstream. The upstream bug has been closed RESOLVED/INVALID. The length check in the current glibc CMSG_NXTHDR macro requires that the you are reading valid data, and the check will not be removed to facilitate setting up of lists. If you are setting up a list you must set it to some known values for the macro to work correctly e.g. memset to zero. |
Description of problem: Version-Release number of selected component (if applicable): glibc-2.17 _EXTERN_INLINE struct cmsghdr * __NTH (__cmsg_nxthdr (struct msghdr *__mhdr, struct cmsghdr *__cmsg)) { if ((size_t) __cmsg->cmsg_len < sizeof (struct cmsghdr)) /* The kernel header does this so there may be a reason. */ return (struct cmsghdr *) 0; __cmsg = (struct cmsghdr *) ((unsigned char *) __cmsg + CMSG_ALIGN (__cmsg->cmsg_len)); if ((unsigned char *) (__cmsg + 1) > ((unsigned char *) __mhdr->msg_control + __mhdr->msg_controllen) || ((unsigned char *) __cmsg + CMSG_ALIGN (__cmsg->cmsg_len) //__cmsg->cmsg_len is unitialized ****************************** > ((unsigned char *) __mhdr->msg_control + __mhdr->msg_controllen))) /* No more entries. */ return (struct cmsghdr *) 0; return __cmsg; } How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: