Re: 2.2.x BUG & PATCH: recvmsg() does not check msg_controllen correctly

2000-11-04 Thread Philippe Troin
"David S. Miller" <[EMAIL PROTECTED]> writes: >From: Philippe Troin <[EMAIL PROTECTED]> >Date: 03 Nov 2000 19:53:04 -0800 > >Yes I agree, mixing signed and unsigned arithmetic is evil... Doesn't >gcc have a flag for unsafe signed/unsigned mixtures ? > >Would you consider

Re: 2.2.x BUG PATCH: recvmsg() does not check msg_controllen correctly

2000-11-04 Thread Philippe Troin
"David S. Miller" [EMAIL PROTECTED] writes: From: Philippe Troin [EMAIL PROTECTED] Date: 03 Nov 2000 19:53:04 -0800 Yes I agree, mixing signed and unsigned arithmetic is evil... Doesn't gcc have a flag for unsafe signed/unsigned mixtures ? Would you consider this patch

Re: 2.2.x BUG & PATCH: recvmsg() does not check msg_controllen correctly

2000-11-03 Thread David S. Miller
From: Philippe Troin <[EMAIL PROTECTED]> Date: 03 Nov 2000 19:53:04 -0800 Yes I agree, mixing signed and unsigned arithmetic is evil... Doesn't gcc have a flag for unsafe signed/unsigned mixtures ? Would you consider this patch (or a variant) for inclusion ? I would accept a

2.2.x BUG & PATCH: recvmsg() does not check msg_controllen correctly

2000-11-03 Thread Philippe Troin
I found this in all 2.2.x kernels, and it might possibly be present in 2.4.x too... When receiving file descriptors via recvmsg(), scm_detach_fds() in net/core/scm.c can overflow user space data at msg_control if msg_controllen is less than sizeof(struct cmsghdr). This is a security problem.

2.2.x BUG PATCH: recvmsg() does not check msg_controllen correctly

2000-11-03 Thread Philippe Troin
I found this in all 2.2.x kernels, and it might possibly be present in 2.4.x too... When receiving file descriptors via recvmsg(), scm_detach_fds() in net/core/scm.c can overflow user space data at msg_control if msg_controllen is less than sizeof(struct cmsghdr). This is a security problem.

Re: 2.2.x BUG PATCH: recvmsg() does not check msg_controllen correctly

2000-11-03 Thread David S. Miller
From: Philippe Troin [EMAIL PROTECTED] Date: 03 Nov 2000 19:53:04 -0800 Yes I agree, mixing signed and unsigned arithmetic is evil... Doesn't gcc have a flag for unsafe signed/unsigned mixtures ? Would you consider this patch (or a variant) for inclusion ? I would accept a patch