print_cmsg() was assuming that the control message chain is well-formed,
but that isn't necessarily the case for sendmsg(2). In particular, if
cmsg_len is zero, print_cmsg() will loop forever. Check for truncated
headers and try to recover if possible.
Details
Details
This was found by running a syzkaller reproducer under truss. Now it prints:
94908: sendmsg(3,{NULL,0,0x0,0,{{level=SOL_SOCKET,type=SCM_RIGHTS,data={}}{<invalid cmsg len=0>}},108,0},0) ERR#22 'Invalid argument'
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Not Applicable - Unit
Tests Not Applicable