casaroli commented on code in PR #18712:
URL: https://github.com/apache/nuttx/pull/18712#discussion_r4434996421
##########
net/socket/sendmsg.c:
##########
@@ -145,11 +149,129 @@ ssize_t sendmsg(int sockfd, FAR const struct msghdr
*msg, int flags)
FAR struct socket *psock;
FAR struct file *filep;
ssize_t ret;
+#ifdef CONFIG_BUILD_KERNEL
+ struct msghdr kmsg;
+ struct msghdr umsg;
+ FAR struct iovec *uiov = NULL;
+ FAR uint8_t *kdata = NULL;
+ FAR void *kname = NULL;
+ FAR void *kcontrol = NULL;
+ FAR const struct msghdr *send_msg = msg;
+ size_t total_len;
+ size_t i;
+ FAR uint8_t *ptr;
+#endif
/* sendmsg() is a cancellation point */
enter_cancellation_point();
+#ifdef CONFIG_BUILD_KERNEL
+ /* Copy user msghdr, iovec array, and payload into kernel memory so the
+ * network stack can safely memcpy from iov bases (see sendto()).
+ */
+
+ memcpy(&umsg, msg, sizeof(struct msghdr));
+
+ if (umsg.msg_iov == NULL)
+ {
+ ret = -EINVAL;
+ goto errout_with_cleanup;
+ }
+
+ if (umsg.msg_iovlen > 0)
+ {
+ uiov = kmm_malloc(umsg.msg_iovlen * sizeof(struct iovec));
+ if (uiov == NULL)
+ {
+ ret = -ENOMEM;
+ goto errout_with_cleanup;
+ }
+
+ memcpy(uiov, msg->msg_iov, umsg.msg_iovlen * sizeof(struct iovec));
+
+ total_len = 0;
+ for (i = 0; i < umsg.msg_iovlen; i++)
+ {
+ total_len += uiov[i].iov_len;
Review Comment:
total_len adds the iov_len values of the caller without an overflow check,
and msg_iovlen has no limit. With iov_len values that wrap the sum (for example
SIZE_MAX and 2), kmm_malloc() gets 1 byte and the copy loop writes SIZE_MAX
bytes into it: a user program overwrites the kernel heap. recvmsg.c:226 has the
same sum.
Fix: return -EINVAL when msg_iovlen > IOV_MAX or when the sum overflows or
is larger than SSIZE_MAX, in sendmsg() and recvmsg().
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
