[PATCH] linux: Check for null value msghdr struct before use

[Adhemerval Zanella]

On 02/07/2021 17:28, Khem Raj wrote:
> This avoids crashes in libc when cmsg is null and refrencing msg

s/refrencing/referencing

> structure when it is null
> 
> Signed-off-by: Khem Raj <raj.khem@gmail.com>

Patch looks ok just some nits below, thank for catching it.  
I will commit it shortly for you.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

> ---
>  sysdeps/unix/sysv/linux/convert_scm_timestamps.c | 2 ++
>  sysdeps/unix/sysv/linux/recvmsg.c                | 4 ++--
>  2 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/sysdeps/unix/sysv/linux/convert_scm_timestamps.c b/sysdeps/unix/sysv/linux/convert_scm_timestamps.c
> index d75a4618dd6..5af71847f57 100644
> --- a/sysdeps/unix/sysv/linux/convert_scm_timestamps.c
> +++ b/sysdeps/unix/sysv/linux/convert_scm_timestamps.c
> @@ -87,6 +87,8 @@ __convert_scm_timestamps (struct msghdr *msg, socklen_t msgsize)
>  
>    msg->msg_controllen += CMSG_SPACE (sizeof tvts);
>    cmsg = CMSG_NXTHDR(msg, last);
> +  if (cmsg == NULL)
> +    return;
>    cmsg->cmsg_level = SOL_SOCKET;
>    cmsg->cmsg_type = type;
>    cmsg->cmsg_len = CMSG_LEN (sizeof tvts);
> diff --git a/sysdeps/unix/sysv/linux/recvmsg.c b/sysdeps/unix/sysv/linux/recvmsg.c
> index a2a600228ba..19c49e2a85c 100644
> --- a/sysdeps/unix/sysv/linux/recvmsg.c
> +++ b/sysdeps/unix/sysv/linux/recvmsg.c
> @@ -25,7 +25,7 @@ __libc_recvmsg (int fd, struct msghdr *msg, int flags)
>  {
>    ssize_t r;
>  #ifndef __ASSUME_TIME64_SYSCALLS
> -  socklen_t orig_controllen = msg->msg_controllen;
> +  socklen_t orig_controllen = (msg) ? msg->msg_controllen : 0;
>  #endif
>  

No implicit checks.

>  #ifdef __ASSUME_RECVMSG_SYSCALL
> @@ -35,7 +35,7 @@ __libc_recvmsg (int fd, struct msghdr *msg, int flags)
>  #endif
>  
>  #ifndef __ASSUME_TIME64_SYSCALLS
> -  if (r >= 0)
> +  if (r >= 0 && orig_controllen)
>      __convert_scm_timestamps (msg, orig_controllen);
>  #endif
>  
> 

Same as before.