From dfbbceed38d59315271e2a7397c1f387a64c451b Mon Sep 17 00:00:00 2001 From: Daniel Mack Date: Mon, 12 Oct 2015 14:44:26 +0200 Subject: [PATCH] sd-daemon: wipe out memory before using CMSG_NXTHDR() CMSG_NXTHDR() checks for cmsg->cmsg_len *after* it increased the pointer. While this makes sense for parsing received messages, that's a pitfall for code crafting messages with this macro. Wipe out the allocated memory to fix this. --- src/libelogind/sd-daemon/sd-daemon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libelogind/sd-daemon/sd-daemon.c b/src/libelogind/sd-daemon/sd-daemon.c index 749a3646d..e10444f49 100644 --- a/src/libelogind/sd-daemon/sd-daemon.c +++ b/src/libelogind/sd-daemon/sd-daemon.c @@ -460,7 +460,7 @@ _public_ int sd_pid_notify_with_fds(pid_t pid, int unset_environment, const char (n_fds > 0 ? CMSG_SPACE(sizeof(int) * n_fds) : 0) + (have_pid ? CMSG_SPACE(sizeof(struct ucred)) : 0); - msghdr.msg_control = alloca(msghdr.msg_controllen); + msghdr.msg_control = alloca0(msghdr.msg_controllen); cmsg = CMSG_FIRSTHDR(&msghdr); if (n_fds > 0) { -- 2.30.2