Merge pull request #3676 from purplesyringa/cmsg-pointer-arithmetic

JohnTitor · web-flow · commit 73efe14b390f · 2024-05-01T16:24:33.000Z
Fix out-of-bounds pointer arithmetic in CMSG_NXTHDR
diff --git a/src/unix/linux_like/linux/mod.rs b/src/unix/linux_like/linux/mod.rs
@@ -4650,7 +4650,7 @@ f! {
             as *mut cmsghdr;
         let max = (*mhdr).msg_control as usize
             + (*mhdr).msg_controllen as usize;
-        if (next.offset(1)) as usize > max ||
+        if (next.wrapping_offset(1)) as usize > max ||
             next as usize + super::CMSG_ALIGN((*next).cmsg_len as usize) > max
         {
             0 as *mut cmsghdr

Original file line number	Diff line number	Diff line change
`@@ -4650,7 +4650,7 @@ f! {`
`4650`	`4650`	`as *mut cmsghdr;`
`4651`	`4651`	`let max = (*mhdr).msg_control as usize`
`4652`	`4652`	`+ (*mhdr).msg_controllen as usize;`
`4653`		`- if (next.offset(1)) as usize > max \|\|`
	`4653`	`+ if (next.wrapping_offset(1)) as usize > max \|\|`
`4654`	`4654`	`next as usize + super::CMSG_ALIGN((*next).cmsg_len as usize) > max`
`4655`	`4655`	`{`
`4656`	`4656`	`0 as *mut cmsghdr`