Bug 185160 - [ConnectionUnix] readBytesFromSocket() wrongly compares cmsg_len with attachmentMaxAmount
Summary: [ConnectionUnix] readBytesFromSocket() wrongly compares cmsg_len with attachm...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Yoshiaki Jitsukawa
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-04-30 23:29 PDT by Yoshiaki Jitsukawa
Modified: 2021-11-01 21:06 PDT (History)
2 users (show)

See Also:


Attachments
Patch (1.91 KB, patch)
2018-04-30 23:50 PDT, Yoshiaki Jitsukawa
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yoshiaki Jitsukawa 2018-04-30 23:29:47 PDT
On the sender side, file descriptors can be attached up to attachmentMaxAmount = 255 and cmsg_len can be CMSG_LEN(0) + attachmentMaxAmount * sizeof(int).
On the receiver side, however, readBytesFromSocket() is doing following comparison:
 if (controlMessage->cmsg_len < CMSG_LEN(0) || controlMessage->cmsg_len > attachmentMaxAmount) {
   ASSERT_NOT_REACHED();
   break;
 }

I suppose this should be
 (controlMessage->cmsg_len - CMSG_LEN(0)) / sizeof(int) > attachmentMaxAmount
as fileDescriptorsCount is calclulated as:
 size_t fileDescriptorsCount = (controlMessage->cmsg_len - CMSG_LEN(0)) / sizeof(int);
Comment 1 Yoshiaki Jitsukawa 2018-04-30 23:50:32 PDT
Created attachment 339189 [details]
Patch
Comment 2 Alex Christensen 2021-11-01 12:06:54 PDT
Comment on attachment 339189 [details]
Patch

This has been requesting review for more than one year.  If this is still needed, please rebase and re-request review.