[Webkit-unassigned] [Bug 185160] New: [ConnectionUnix] readBytesFromSocket() wrongly compares cmsg_len with attachmentMaxAmount

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=185160

            Bug ID: 185160
           Summary: [ConnectionUnix] readBytesFromSocket() wrongly
                    compares cmsg_len with attachmentMaxAmount
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit Misc.
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: Yoshiaki_Jitsukawa at hq.scei.sony.co.jp

On the sender side, file descriptors can be attached up to attachmentMaxAmount = 255 and cmsg_len can be CMSG_LEN(0) + attachmentMaxAmount * sizeof(int).
On the receiver side, however, readBytesFromSocket() is doing following comparison:
 if (controlMessage->cmsg_len < CMSG_LEN(0) || controlMessage->cmsg_len > attachmentMaxAmount) {
   ASSERT_NOT_REACHED();
   break;
 }

I suppose this should be
 (controlMessage->cmsg_len - CMSG_LEN(0)) / sizeof(int) > attachmentMaxAmount
as fileDescriptorsCount is calclulated as:
 size_t fileDescriptorsCount = (controlMessage->cmsg_len - CMSG_LEN(0)) / sizeof(int);

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180501/e85e53bf/attachment.html>