Module Name: src
Committed By: maxv
Date: Mon Jul 29 09:42:17 UTC 2019
Modified Files:
src/sys/kern: uipc_usrreq.c
Log Message:
Fix info leak: the padding after the header causes uninitialized heap
memory to be copied to userland in sys_recvmsg().
To generate a diff of this commit:
cvs rdiff -u -r1.193 -r1.194 src/sys/kern/uipc_usrreq.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/uipc_usrreq.c
diff -u src/sys/kern/uipc_usrreq.c:1.193 src/sys/kern/uipc_usrreq.c:1.194
--- src/sys/kern/uipc_usrreq.c:1.193 Mon Jun 3 06:04:20 2019
+++ src/sys/kern/uipc_usrreq.c Mon Jul 29 09:42:17 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: uipc_usrreq.c,v 1.193 2019/06/03 06:04:20 msaitoh Exp $ */
+/* $NetBSD: uipc_usrreq.c,v 1.194 2019/07/29 09:42:17 maxv Exp $ */
/*-
* Copyright (c) 1998, 2000, 2004, 2008, 2009 The NetBSD Foundation, Inc.
@@ -96,7 +96,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_usrreq.c,v 1.193 2019/06/03 06:04:20 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_usrreq.c,v 1.194 2019/07/29 09:42:17 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_compat_netbsd.h"
@@ -1573,6 +1573,7 @@ unp_internalize(struct mbuf **controlp)
goto out;
}
memcpy(newcm, cm, sizeof(struct cmsghdr));
+ memset(newcm + 1, 0, CMSG_LEN(0) - sizeof(struct cmsghdr));
files = (file_t **)CMSG_DATA(newcm);
/*
