Subject: [advanced API] possible infinite loop in cmsg data examination

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Mon, 06 Nov 2000 00:15:12 +0900

I'm not sure if this list is the right place, but I have a tiny
comment about the defintion and the typical usage of CMSG_NXTHDR().

draft-ietf-ipngwg-2292bis-01.txt describes CMSG_NXTHDR with the
following definition and the example:

       while ((cmsgptr = CMSG_NXTHDR(&msg, cmsgptr)) != NULL) {
           if (cmsgptr->cmsg_level == ... && cmsgptr->cmsg_type == ... ) {
               u_char  *ptr;

               ptr = CMSG_DATA(cmsgptr);
               /* process data pointed to by ptr */
           }
       }
where
       #define CMSG_NXTHDR(mhdr, cmsg) \
         (((cmsg) == NULL) ? CMSG_FIRSTHDR(mhdr) : \
          (((u_char *)(cmsg) + ALIGN_H((cmsg)->cmsg_len) \
                             + ALIGN_D(sizeof(struct cmsghdr)) > \
            (u_char *)((mhdr)->msg_control) + (mhdr)->msg_controllen) ? \
           (struct cmsghdr *)NULL : \
           (struct cmsghdr *)((u_char *)(cmsg) + ALIGN_H((cmsg)->cmsg_len))))

I think this combination is a bit dangerous, since the while loop will
not stop if the cmsg_len member of a cmsg data is 0. In fact, a BSD
derived system has this type of while loop in its kernel with the
(logically) same definition of CMSG_NXTHDR. As a result, a user
program can make the kernel hang by sending forged ancillary data.

So, I'd suggest to add some warning in the example about the
possibility of the infinite loop or to rewrite the example itself like
this:

       while ((cmsgptr = CMSG_NXTHDR(&msg, cmsgptr)) != NULL) {
	   if (cmsgptr->cmsg_len == 0)
		break; /* and return some error if necessary */
           if (cmsgptr->cmsg_level == ... && cmsgptr->cmsg_type == ... ) {
               u_char  *ptr;

               ptr = CMSG_DATA(cmsgptr);
               /* process data pointed to by ptr */
           }
       }

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 6 Nov 2000 13:06:19 -0800 (PST)

> 		break; /* and return some error if necessary */

I'll add this check to the two examples in the document.

  Erik