bug-gnulib
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH] passfd: fix use of uninitialised variable


From: Pádraig Brady
Subject: Re: [PATCH] passfd: fix use of uninitialised variable
Date: Tue, 24 Feb 2015 12:17:19 +0000
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0

On 24/02/15 10:14, Pavel Hrdina wrote:
> This was found by running libvirt using valgrind. Commit ee195daf
> introduced passfd code.
> 
> ==7533== Syscall param sendmsg(msg.msg_control) points to uninitialised 
> byte(s)
> ==7533==    at 0x8C728FD: ??? (in /lib64/libpthread-2.19.so)
> ==7533==    by 0x54F04D1: sendfd (passfd.c:86)
> ==7533==    by 0x5437881: virNetSocketSendFD (virnetsocket.c:1766)
> ==7533==    by 0x542C328: virNetServerClientDispatchWrite 
> (virnetserverclient.c:1271)
> ==7533==    by 0x542C328: virNetServerClientDispatchEvent 
> (virnetserverclient.c:1371)
> ==7533==    by 0x52CA076: virEventPollDispatchHandles (vireventpoll.c:508)
> ==7533==    by 0x52CA076: virEventPollRunOnce (vireventpoll.c:657)
> ==7533==    by 0x52C8581: virEventRunDefaultImpl (virevent.c:308)
> ==7533==    by 0x1578FC: virNetServerRun (virnetserver.c:1139)
> ==7533==    by 0x11E3EC: main (libvirtd.c:1491)
> ==7533==  Address 0xffefff3f4 is on thread 1's stack
> ==7533==  in frame #1, created by sendfd (passfd.c:51)
> 
> Signed-off-by: Pavel Hrdina <address@hidden>
> ---
>  lib/passfd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/passfd.c b/lib/passfd.c
> index 1958776..d832268 100644
> --- a/lib/passfd.c
> +++ b/lib/passfd.c
> @@ -54,7 +54,7 @@ sendfd (int sock, int fd)
>    struct msghdr msg;
>  # ifdef CMSG_FIRSTHDR
>    struct cmsghdr *cmsg;
> -  char buf[CMSG_SPACE (sizeof fd)];
> +  char buf[CMSG_SPACE (sizeof fd)] = "";
>  # endif
>  
>    /* send at least one char */

While that works, it introduces redundant clearing of alignment slop space.
I'll commit the following in your name instead. Can you check it passes?

thanks,
Pádraig.

diff --git a/lib/passfd.c b/lib/passfd.c
index 1958776..4d6b813 100644
--- a/lib/passfd.c
+++ b/lib/passfd.c
@@ -75,6 +75,7 @@ sendfd (int sock, int fd)
   cmsg->cmsg_len = CMSG_LEN (sizeof fd);
   /* Initialize the payload: */
   memcpy (CMSG_DATA (cmsg), &fd, sizeof fd);
+  msg.msg_controllen = cmsg->cmsg_len;
 # elif HAVE_STRUCT_MSGHDR_MSG_ACCRIGHTS
   msg.msg_accrights = &fd;
   msg.msg_accrightslen = sizeof fd;




reply via email to

[Prev in Thread] Current Thread [Next in Thread]