[src/trunk]: src/sys/kern Fix info leak: the padding after the header causes ...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/7286994b5c1d
branches:  trunk
changeset: 458075:7286994b5c1d
user:      maxv <maxv%NetBSD.org@localhost>
date:      Mon Jul 29 09:42:17 2019 +0000

description:
Fix info leak: the padding after the header causes uninitialized heap
memory to be copied to userland in sys_recvmsg().

diffstat:

 sys/kern/uipc_usrreq.c |  5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diffs (26 lines):

diff -r 673c1c0d2912 -r 7286994b5c1d sys/kern/uipc_usrreq.c
--- a/sys/kern/uipc_usrreq.c    Mon Jul 29 09:33:21 2019 +0000
+++ b/sys/kern/uipc_usrreq.c    Mon Jul 29 09:42:17 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: uipc_usrreq.c,v 1.193 2019/06/03 06:04:20 msaitoh Exp $        */
+/*     $NetBSD: uipc_usrreq.c,v 1.194 2019/07/29 09:42:17 maxv Exp $   */
 
 /*-
  * Copyright (c) 1998, 2000, 2004, 2008, 2009 The NetBSD Foundation, Inc.
@@ -96,7 +96,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_usrreq.c,v 1.193 2019/06/03 06:04:20 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_usrreq.c,v 1.194 2019/07/29 09:42:17 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_compat_netbsd.h"
@@ -1573,6 +1573,7 @@
                goto out;
        }
        memcpy(newcm, cm, sizeof(struct cmsghdr));
+       memset(newcm + 1, 0, CMSG_LEN(0) - sizeof(struct cmsghdr));
        files = (file_t **)CMSG_DATA(newcm);
 
        /*