Module Name: src
Committed By: martin
Date: Wed Aug 7 08:21:55 UTC 2019
Modified Files:
src/sys/kern [netbsd-8]: uipc_socket2.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1330):
sys/kern/uipc_socket2.c: revision 1.134
Fix info leaks: the alignment of the structures causes uninitialized heap
memory to be copied to userland in sys_recvmsg().
To generate a diff of this commit:
cvs rdiff -u -r1.124.8.3 -r1.124.8.4 src/sys/kern/uipc_socket2.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/uipc_socket2.c
diff -u src/sys/kern/uipc_socket2.c:1.124.8.3 src/sys/kern/uipc_socket2.c:1.124.8.4
--- src/sys/kern/uipc_socket2.c:1.124.8.3 Tue Jul 31 17:01:20 2018
+++ src/sys/kern/uipc_socket2.c Wed Aug 7 08:21:55 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: uipc_socket2.c,v 1.124.8.3 2018/07/31 17:01:20 martin Exp $ */
+/* $NetBSD: uipc_socket2.c,v 1.124.8.4 2019/08/07 08:21:55 martin Exp $ */
/*-
* Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -58,7 +58,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_socket2.c,v 1.124.8.3 2018/07/31 17:01:20 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_socket2.c,v 1.124.8.4 2019/08/07 08:21:55 martin Exp $");
#ifdef _KERNEL_OPT
#include "opt_ddb.h"
@@ -1419,6 +1419,10 @@ sbcreatecontrol1(void **p, int size, int
cp->cmsg_len = CMSG_LEN(size);
cp->cmsg_level = level;
cp->cmsg_type = type;
+
+ memset(cp + 1, 0, CMSG_LEN(0) - sizeof(*cp));
+ memset((uint8_t *)*p + size, 0, CMSG_ALIGN(size) - size);
+
return m;
}
