[PATCH] bug in sysdeps/unix/sysv/linux/cmsg_nxthdr.c

[James Antill]

 There is a bug in sysdeps/unix/sysv/linux/cmsg_nxthdr.c in both
glibc-2.1.3 and glibc-2.2.2 ... the bug stops the function from
returning data for the last CMSG in the list (so you always lose one
when you have 2 or more).

 The test is performing (in English)...

1. If the size of a zero length control message is equal to or greater
than the space available, fail.

2. If the size specified in the control message is equal to or greater
than the space available, fail.

 However the second test is valid, and should only fail if it is
greater.

 Here is the patch...

--- sysdeps/unix/sysv/linux/cmsg_nxthdr.c-orig	Sun Feb 25 19:53:03 2001
+++ sysdeps/unix/sysv/linux/cmsg_nxthdr.c	Sun Feb 25 19:53:27 2001
@@ -32,7 +32,7 @@
   if ((unsigned char *) (cmsg + 1) >= ((unsigned char *) mhdr->msg_control
 				       + mhdr->msg_controllen)
       || ((unsigned char *) cmsg + CMSG_ALIGN (cmsg->cmsg_len)
-	  >= ((unsigned char *) mhdr->msg_control + mhdr->msg_controllen)))
+	  > ((unsigned char *) mhdr->msg_control + mhdr->msg_controllen)))
     /* No more entries.  */
     return NULL;
   return cmsg;


 Here is a test case...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: recvmsg_example.c
Type: text/x-c
Size: 2164 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20010225/41cfd8e2/attachment.bin>