Hi,

while running some ported tests I noticed that msgsnd(2) did not error
when passing a message with mtype < 1, even tho the manual page states:
> mtype is an integer greater than 0 that can be used

POSIX says:
https://pubs.opengroup.org/onlinepubs/9699919799/
[EINVAL]
    The value of msqid is not a valid message queue identifier, or the value of 
mtype is less than 1; or the value of msgsz is greater than the system-imposed 
limit.

Here is a minimal test:

#include <sys/msg.h>

struct msg {
        long             mtype;
        char             buf[3];
};

int
main(void)
{
        struct msg msg = { 0, { 'a', 'b', 'c' } };
        int id;

        id = msgget(1234, IPC_CREAT | 0600);

        // man 2 msgsnd: mtype is an integer greater than 0 ...
        if (msgsnd(id, &msg, sizeof(struct msg), IPC_NOWAIT) == -1)
                return 0;
        return 1;
}

and the patch follows.

greetings,
mbuhl


Index: sys/kern/sysv_msg.c
===================================================================
RCS file: /cvs/src/sys/kern/sysv_msg.c,v
retrieving revision 1.34
diff -u -p -r1.34 sysv_msg.c
--- sys/kern/sysv_msg.c 5 Dec 2018 15:42:45 -0000       1.34
+++ sys/kern/sysv_msg.c 12 Jul 2019 15:03:16 -0000
@@ -588,7 +588,7 @@ msg_copyin(struct msg *msg, const char *
                return (error);
        }
 
-       if (msg->msg_type < 0) {
+       if (msg->msg_type <= 0) {
                msg_free(msg);
                return (EINVAL);
        }

Reply via email to