Fix out-of-bounds pointer arithmetic in CMSG_NXTHDR

purplesyringa · tgross35 · commit a6caa32c6cca · 2024-08-28T19:53:47.000-04:00
(apply <#3676> to `main`) (cherry picked from commit dc88f4c)
diff --git a/src/unix/linux_like/linux/mod.rs b/src/unix/linux_like/linux/mod.rs
@@ -5138,7 +5138,7 @@ f! {
             as *mut cmsghdr;
         let max = (*mhdr).msg_control as usize
             + (*mhdr).msg_controllen as usize;
-        if (next.offset(1)) as usize > max ||
+        if (next.wrapping_offset(1)) as usize > max ||
             next as usize + super::CMSG_ALIGN((*next).cmsg_len as usize) > max
         {
             0 as *mut cmsghdr

Original file line number	Diff line number	Diff line change
`@@ -5138,7 +5138,7 @@ f! {`
`5138`	`5138`	`as *mut cmsghdr;`
`5139`	`5139`	`let max = (*mhdr).msg_control as usize`
`5140`	`5140`	`+ (*mhdr).msg_controllen as usize;`
`5141`		`- if (next.offset(1)) as usize > max \|\|`
	`5141`	`+ if (next.wrapping_offset(1)) as usize > max \|\|`
`5142`	`5142`	`next as usize + super::CMSG_ALIGN((*next).cmsg_len as usize) > max`
`5143`	`5143`	`{`
`5144`	`5144`	`0 as *mut cmsghdr`