Messages in this thread |  | | Date | Wed, 22 Aug 2001 19:07:36 +0300 | | From | "Octavian Cerna" <> | | Subject | [PATCH] Bug in sendto() causes OOPS when using RAW sockets |
| |
Hi,
Studying the implementation of raw IPv4 sockets I found that calling sendto() on a raw socket with a NULL socket address generates a kernel OOPS.
I checked this on kernel 2.4.3, but I also checked the sources in CVS on vger -- the bug is still there.
The problem is that raw_sendmsg() in net/ipv4/raw.c blindly assumes that msg_name is valid if msg_namelen is non-zero. I found that sys_sendto() doesn't correctly build the msghdr structure if the socket address is NULL.
I attached a small patch to fix this issue, a C program for testing the problem and my OOPS log.
Best Regards,
Octavian Cerna IGREC Labs [unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream]
|  |