sys/socket/scm: return NULL when cmsg_len is zero

Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This commit is contained in:
dongjiuzhu1
2022-11-10 16:31:01 +08:00
committed by Xiang Xiao
parent d5f729ed25
commit 5d643b3bef
+5 -4
View File
@@ -348,11 +348,12 @@ static inline FAR struct cmsghdr *__cmsg_nxthdr(FAR void *__ctl,
unsigned int __size, unsigned int __size,
FAR struct cmsghdr *__cmsg) FAR struct cmsghdr *__cmsg)
{ {
FAR struct cmsghdr *__ptr; size_t len = CMSG_ALIGN(__cmsg->cmsg_len);
FAR struct cmsghdr *__ptr =
(FAR struct cmsghdr *)(((FAR char *)__cmsg) + len);
__ptr = (FAR struct cmsghdr *) if (len < sizeof(*__cmsg) ||
(((FAR char *)__cmsg) + CMSG_ALIGN(__cmsg->cmsg_len)); (unsigned long)((FAR char *)(__ptr + 1) - (FAR char *)__ctl) > __size)
if ((unsigned long)((FAR char *)(__ptr + 1) - (FAR char *)__ctl) > __size)
{ {
return NULL; return NULL;
} }