Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 29 Jun 2022 14:40:53 GMT
From:      Mark Johnston <markj@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: 3d81c26f92e1 - stable/13 - truss: Make control message header parsing more robust
Message-ID:  <202206291440.25TEerKg031660@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch stable/13 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=3d81c26f92e14db25dcc6046af1493c0d5a75443

commit 3d81c26f92e14db25dcc6046af1493c0d5a75443
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2022-06-14 15:34:57 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2022-06-29 14:12:33 +0000

    truss: Make control message header parsing more robust
    
    print_cmsg() was assuming that the control message chain is well-formed,
    but that isn't necessarily the case for sendmsg(2).  In particular, if
    cmsg_len is zero, print_cmsg() will loop forever.  Check for truncated
    headers and try to recover if possible.
    
    Reviewed by:    tuexen
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit 4b0c6fa0dceac797f43dffd5642c1aed727c6ea6)
---
 usr.bin/truss/syscalls.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/usr.bin/truss/syscalls.c b/usr.bin/truss/syscalls.c
index 06e984de3fe8..cf863d2bfaaa 100644
--- a/usr.bin/truss/syscalls.c
+++ b/usr.bin/truss/syscalls.c
@@ -1663,6 +1663,16 @@ print_cmsgs(FILE *fp, pid_t pid, bool receive, struct msghdr *msghdr)
 	for (cmsghdr = CMSG_FIRSTHDR(msghdr);
 	   cmsghdr != NULL;
 	   cmsghdr = CMSG_NXTHDR(msghdr, cmsghdr)) {
+		if (cmsghdr->cmsg_len < sizeof(*cmsghdr)) {
+			fprintf(fp, "{<invalid cmsg, len=%u>}",
+			    cmsghdr->cmsg_len);
+			if (cmsghdr->cmsg_len == 0) {
+				/* Avoid looping forever. */
+				break;
+			}
+			continue;
+		}
+
 		level = cmsghdr->cmsg_level;
 		type = cmsghdr->cmsg_type;
 		len = cmsghdr->cmsg_len;



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202206291440.25TEerKg031660>