From 5d643b3bef3e39ca61c92af4f854c8480692c5ea Mon Sep 17 00:00:00 2001 From: dongjiuzhu1 Date: Thu, 10 Nov 2022 16:31:01 +0800 Subject: [PATCH] sys/socket/scm: return NULL when cmsg_len is zero Signed-off-by: dongjiuzhu1 --- include/sys/socket.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/include/sys/socket.h b/include/sys/socket.h index aa633ec7a47..28cd2714919 100644 --- a/include/sys/socket.h +++ b/include/sys/socket.h @@ -348,11 +348,12 @@ static inline FAR struct cmsghdr *__cmsg_nxthdr(FAR void *__ctl, unsigned int __size, FAR struct cmsghdr *__cmsg) { - FAR struct cmsghdr *__ptr; + size_t len = CMSG_ALIGN(__cmsg->cmsg_len); + FAR struct cmsghdr *__ptr = + (FAR struct cmsghdr *)(((FAR char *)__cmsg) + len); - __ptr = (FAR struct cmsghdr *) - (((FAR char *)__cmsg) + CMSG_ALIGN(__cmsg->cmsg_len)); - if ((unsigned long)((FAR char *)(__ptr + 1) - (FAR char *)__ctl) > __size) + if (len < sizeof(*__cmsg) || + (unsigned long)((FAR char *)(__ptr + 1) - (FAR char *)__ctl) > __size) { return NULL; }