On Wed, Oct 09, 2013 at 08:38:06AM +0200, Tomas Mraz wrote:
On Út, 2013-10-01 at 21:23 +0200, Tomas Mraz wrote:
On Út, 2013-10-01 at 15:01 -0400, Richard Guy Briggs wrote:
modules/pam_tty_audit/pam_tty_audit.c: Deal with mismatched message size. (nl_recv): Pad result with zeros if message is short from older kernel.
Signed-off-by: Richard Guy Briggs rgb@redhat.com
modules/pam_tty_audit/pam_tty_audit.c | 9 +++++++-- 1 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/modules/pam_tty_audit/pam_tty_audit.c b/modules/pam_tty_audit/pam_tty_audit.c index cc86255..a1a3aa4 100644 --- a/modules/pam_tty_audit/pam_tty_audit.c +++ b/modules/pam_tty_audit/pam_tty_audit.c @@ -109,7 +109,7 @@ nl_recv (int fd, unsigned type, void *buf, size_t size) struct msghdr msg; struct nlmsghdr nlm; struct iovec iov[2];
- ssize_t res;
ssize_t res, resdiff;
again: iov[0].iov_base = &nlm;
@@ -161,12 +161,17 @@ nl_recv (int fd, unsigned type, void *buf, size_t size) res = recvmsg (fd, &msg, 0); if (res == -1) return -1;
- if ((size_t)res != NLMSG_LENGTH (size)
- resdiff = NLMSG_LENGTH(size) - (size_t)res;
- if (resdiff < 0 || nlm.nlmsg_type != type) { errno = EIO; return -1; }
- else if (resdiff > 0)
- {
memset(buf[size - resdiff], 0, resdiff);
Of course this should better be: memset((char *)buf + res, 0, resdiff);
Yes, I can see how that would cause an overrun...
Which is of course incorrect and should be memset((char *)buf + size - resdiff, 0, resdiff);
Yes, this does look like what I had intended.
OK to commit?
Looks good to me.
Tomas Mraz
- RGB
-- Richard Guy Briggs rbriggs@redhat.com Senior Software Engineer Kernel Security AMER ENG Base Operating Systems Remote, Ottawa, Canada Voice: +1.647.777.2635 Internal: (81) 32635 Alt: +1.613.693.0684x3545