[lkml]   [2001]   [Aug]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH] Bug in sendto() causes OOPS when using RAW sockets


Studying the implementation of raw IPv4 sockets I found that calling
sendto() on a raw socket with a NULL socket address generates a kernel

I checked this on kernel 2.4.3, but I also checked the sources in CVS on
vger -- the bug is still there.

The problem is that raw_sendmsg() in net/ipv4/raw.c blindly assumes that
msg_name is valid if msg_namelen is non-zero. I found that sys_sendto()
doesn't correctly build the msghdr structure if the socket address is

I attached a small patch to fix this issue, a C program for testing the
problem and my OOPS log.

Best Regards,

Octavian Cerna
[unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream]
 \ /
  Last update: 2005-03-22 12:57    [W:1.045 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site