Skip to content

Commit 91950be

Browse files
committed
Use as_mut_ptr() to initialize msg_name in pack_mhdr_to_receive
The msg_name field points to a caller-allocated buffer that is used to return the source address if the socket is unconnected. The caller should set msg_namelen to the size of this buffer before this call; upon return from a successful call, msg_namelen will contain the length of the returned address. If the application does not need to know the source address, msg_name can be specified as NULL. In case we use () msgname_len gets initialized with 0, but a dangling pointer to the array with msg_name. This works for the first iteration somehow, but after that kernel sets msgname_len to a non-zero and second invocation with the same MultiHeader fails Fixes #2506
1 parent a41a1f0 commit 91950be

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

src/sys/socket/mod.rs

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2059,7 +2059,10 @@ unsafe fn pack_mhdr_to_receive<S>(
20592059
let mut mhdr = mem::MaybeUninit::<msghdr>::zeroed();
20602060
let p = mhdr.as_mut_ptr();
20612061
unsafe {
2062-
(*p).msg_name = address as *mut c_void;
2062+
// it is important to use as_mut_ptr() here since S can be
2063+
// a zero sized type representing by a dangling pointer.
2064+
// as_mut_ptr() handles this case and uses a null pointer instead
2065+
(*p).msg_name = (*address).as_mut_ptr();
20632066
(*p).msg_namelen = S::size();
20642067
(*p).msg_iov = iov_buffer as *mut iovec;
20652068
(*p).msg_iovlen = iov_buffer_len as _;

0 commit comments

Comments
 (0)