On Wed, Oct 09, 2013 at 08:38:06AM +0200, Tomas Mraz wrote:
On Út, 2013-10-01 at 21:23 +0200, Tomas Mraz wrote:
> On Út, 2013-10-01 at 15:01 -0400, Richard Guy Briggs wrote:
> > modules/pam_tty_audit/pam_tty_audit.c: Deal with mismatched message size.
> > (nl_recv): Pad result with zeros if message is short from older kernel.
> >
> > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
> > ---
> > modules/pam_tty_audit/pam_tty_audit.c | 9 +++++++--
> > 1 files changed, 7 insertions(+), 2 deletions(-)
> >
> > diff --git a/modules/pam_tty_audit/pam_tty_audit.c
b/modules/pam_tty_audit/pam_tty_audit.c
> > index cc86255..a1a3aa4 100644
> > --- a/modules/pam_tty_audit/pam_tty_audit.c
> > +++ b/modules/pam_tty_audit/pam_tty_audit.c
> > @@ -109,7 +109,7 @@ nl_recv (int fd, unsigned type, void *buf, size_t size)
> > struct msghdr msg;
> > struct nlmsghdr nlm;
> > struct iovec iov[2];
> > - ssize_t res;
> > + ssize_t res, resdiff;
> >
> > again:
> > iov[0].iov_base = &nlm;
> > @@ -161,12 +161,17 @@ nl_recv (int fd, unsigned type, void *buf, size_t size)
> > res = recvmsg (fd, &msg, 0);
> > if (res == -1)
> > return -1;
> > - if ((size_t)res != NLMSG_LENGTH (size)
> > + resdiff = NLMSG_LENGTH(size) - (size_t)res;
> > + if (resdiff < 0
> > || nlm.nlmsg_type != type)
> > {
> > errno = EIO;
> > return -1;
> > }
> > + else if (resdiff > 0)
> > + {
> > + memset(buf[size - resdiff], 0, resdiff);
> Of course this should better be:
> memset((char *)buf + res, 0, resdiff);
Yes, I can see how that would cause an overrun...
Which is of course incorrect and should be
memset((char *)buf + size - resdiff, 0, resdiff);
Yes, this does look like what I had intended.
OK to commit?
Looks good to me.
Tomas Mraz
- RGB
--
Richard Guy Briggs <rbriggs(a)redhat.com>
Senior Software Engineer
Kernel Security
AMER ENG Base Operating Systems
Remote, Ottawa, Canada
Voice: +1.647.777.2635
Internal: (81) 32635
Alt: +1.613.693.0684x3545