[advanced API] possible infinite loop in cmsg data examination

[JINMEI Tatuya / 神明達哉]

I'm not sure if this list is the right place, but I have a tiny
comment about the defintion and the typical usage of CMSG_NXTHDR().

draft-ietf-ipngwg-2292bis-01.txt describes CMSG_NXTHDR with the
following definition and the example:

       while ((cmsgptr = CMSG_NXTHDR(&msg, cmsgptr)) != NULL) {
           if (cmsgptr->cmsg_level == ... && cmsgptr->cmsg_type == ... ) {
               u_char  *ptr;

               ptr = CMSG_DATA(cmsgptr);
               /* process data pointed to by ptr */
           }
       }
where
       #define CMSG_NXTHDR(mhdr, cmsg) \
         (((cmsg) == NULL) ? CMSG_FIRSTHDR(mhdr) : \
          (((u_char *)(cmsg) + ALIGN_H((cmsg)->cmsg_len) \
                             + ALIGN_D(sizeof(struct cmsghdr)) > \
            (u_char *)((mhdr)->msg_control) + (mhdr)->msg_controllen) ? \
           (struct cmsghdr *)NULL : \
           (struct cmsghdr *)((u_char *)(cmsg) + ALIGN_H((cmsg)->cmsg_len))))

I think this combination is a bit dangerous, since the while loop will
not stop if the cmsg_len member of a cmsg data is 0. In fact, a BSD
derived system has this type of while loop in its kernel with the
(logically) same definition of CMSG_NXTHDR. As a result, a user
program can make the kernel hang by sending forged ancillary data.

So, I'd suggest to add some warning in the example about the
possibility of the infinite loop or to rewrite the example itself like
this:

       while ((cmsgptr = CMSG_NXTHDR(&msg, cmsgptr)) != NULL) {
           if (cmsgptr->cmsg_len == 0)
                break; /* and return some error if necessary */
           if (cmsgptr->cmsg_level == ... && cmsgptr->cmsg_type == ... ) {
               u_char  *ptr;

               ptr = CMSG_DATA(cmsgptr);
               /* process data pointed to by ptr */
           }
       }

                                        JINMEI, Tatuya
                                        Communication Platform Lab.
                                        Corporate R&D Center, Toshiba Corp.
                                        [EMAIL PROTECTED]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [EMAIL PROTECTED]
--------------------------------------------------------------------