Charles-François Natali <neolo...@free.fr> added the comment: I checked in glibc, FreeBSD and OpenBSD source codes, and they all define socklen_t as an unsigned integer. I think the confusion arises from this: """ The third argument of accept() was originally declared as an int * (and is that under libc4 and libc5 and on many other systems like 4.x BSD, SunOS 4, SGI); a POSIX.1g draft standard wanted to change it into a size_t *, and that is what it is for SunOS 5. Later POSIX drafts have socklen_t *, and so do the Single Unix Specification and glibc2. """
But this only implies that sizeof(socklen_t) == sizeof(int). > since it's set by the kernel. The only place where we compute it is in sock_sendmsg, but it would be catched by overflow checks: if (controllen > SOCKLEN_T_LIMIT || controllen < controllen_last) { PyErr_SetString(socket_error, "too much ancillary data"); goto finally; } And we use it as malloc() and memset() argument before it's checked by cmsg_min_space... ---------- _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue12837> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com