CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/08/26 02:26:30
Modified files:
sys/kern : uipc_syscalls.c
Log message:
Fix control message handling in recvit to avoid out of bounds write
to userland
Because of the use of a unsigned variable to track the length of the
control buffer recvit can underflow that variable because of an unchecked
ALIGN(). This can be triggered by passing a too short buffer that is not a
multiple of _ALIGNBYTES + 1. In such a case the kernel copies out data past
the provided buffer.
On top of addding the missing overflow check this also uses the proper
socklen_t type for the msg_controllen and uses an unsigned int for the
still overloaded variable i.
The security implications of this are mainly theoretical. The correct use
of control message handling requires the use of CMSG_SPACE which ensures
the buffer size is properly rounded. In base only dig uses a buffer that
is not correctly rounded at the same time it is oversized enough to not
matter.
Reported by Acts1631 who also provided a fix
OK millert@ deraadt@
