Module Name: src
Committed By: maxv
Date: Thu Jul 11 17:30:44 UTC 2019
Modified Files:
src/sys/kern: uipc_socket2.c
Log Message:
Fix info leaks: the alignment of the structures causes uninitialized heap
memory to be copied to userland in sys_recvmsg().
To generate a diff of this commit:
cvs rdiff -u -r1.133 -r1.134 src/sys/kern/uipc_socket2.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/uipc_socket2.c
diff -u src/sys/kern/uipc_socket2.c:1.133 src/sys/kern/uipc_socket2.c:1.134
--- src/sys/kern/uipc_socket2.c:1.133 Sun Nov 4 16:30:29 2018
+++ src/sys/kern/uipc_socket2.c Thu Jul 11 17:30:44 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: uipc_socket2.c,v 1.133 2018/11/04 16:30:29 christos Exp $ */
+/* $NetBSD: uipc_socket2.c,v 1.134 2019/07/11 17:30:44 maxv Exp $ */
/*-
* Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -58,7 +58,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_socket2.c,v 1.133 2018/11/04 16:30:29 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_socket2.c,v 1.134 2019/07/11 17:30:44 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_ddb.h"
@@ -1421,6 +1421,10 @@ sbcreatecontrol1(void **p, int size, int
cp->cmsg_len = CMSG_LEN(size);
cp->cmsg_level = level;
cp->cmsg_type = type;
+
+ memset(cp + 1, 0, CMSG_LEN(0) - sizeof(*cp));
+ memset((uint8_t *)*p + size, 0, CMSG_ALIGN(size) - size);
+
return m;
}
