Unsafety in CMSG_* on invalid buffers
Open
Nobody has claimed this yet.
C-bug
E-medium
I-needs-decision
I-unsound 💥
- Dominant language
- Rust
- Stars
- 2.6k
- Forks
- 1.3k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 69
Description
The CMSG_* code is unsafe if the buffers passed to it are malformed. This is not a problem if they come from the kernel (the usual case), since the kernel only generates valid buffers. It is, however, a problem if they come from any other source.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the CMSG_* code in the libc bindings and examine how malformed buffers are handled. Build a minimal dependency-free reproduction using an invalid buffer, as requested by the issue template, and compare the behavior with valid kernel-generated buffers. Done is not defined by the issue, so the expected safety behavior needs clarification before implementation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, rust
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100