From: Roy Marples <roy@marples.name>
Date: Wed, 8 Jan 2020 16:07:58 +0000 (+0000)
Subject: privsep: Pad structs out so there are no uninited memory issues
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4c212ae174dd5d4eb3afc230bcce6cea6e0970d7;p=thirdparty%2Fdhcpcd.git

privsep: Pad structs out so there are no uninited memory issues

Add #ifdef'd out debug code for them as well.
---

diff --git a/src/privsep.c b/src/privsep.c
index c8a59793..3eee0f48 100644
--- a/src/privsep.c
+++ b/src/privsep.c
@@ -48,6 +48,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <grp.h>
+#include <stddef.h>	/* For offsetof, struct padding debug */
 #include <signal.h>
 #include <stdlib.h>
 #include <string.h>
@@ -480,6 +481,31 @@ ps_sendmsg(struct dhcpcd_ctx *ctx, int fd, uint8_t cmd, unsigned long flags,
 		.ps_datalen = msg->msg_iov[0].iov_len,
 	};
 
+#if 0	/* For debugging structure padding. */
+	logerrx("psa.addr %lu %zu", offsetof(struct ps_addr, psa_family), sizeof(psm.ps_id.psi_addr.psa_family));
+	logerrx("psa.pad %lu %zu", offsetof(struct ps_addr, psa_pad), sizeof(psm.ps_id.psi_addr.psa_pad));
+	logerrx("psa.psa_u %lu %zu", offsetof(struct ps_addr, psa_u), sizeof(psm.ps_id.psi_addr.psa_u));
+	logerrx("psa %zu", sizeof(psm.ps_id.psi_addr));
+
+	logerrx("psi.addr %lu %zu", offsetof(struct ps_id, psi_addr), sizeof(psm.ps_id.psi_addr));
+	logerrx("psi.index %lu %zu", offsetof(struct ps_id, psi_ifindex), sizeof(psm.ps_id.psi_ifindex));
+	logerrx("psi.cmd %lu %zu", offsetof(struct ps_id, psi_cmd), sizeof(psm.ps_id.psi_cmd));
+	logerrx("psi.pad %lu %zu", offsetof(struct ps_id, psi_pad), sizeof(psm.ps_id.psi_pad));
+	logerrx("psi %zu", sizeof(struct ps_id));
+
+	logerrx("ps_cmd %lu", offsetof(struct ps_msghdr, ps_cmd));
+	logerrx("ps_pad %lu %zu", offsetof(struct ps_msghdr, ps_pad), sizeof(psm.ps_pad));
+	logerrx("ps_flags %lu %zu", offsetof(struct ps_msghdr, ps_flags), sizeof(psm.ps_flags));
+
+	logerrx("ps_id %lu %zu", offsetof(struct ps_msghdr, ps_id), sizeof(psm.ps_id));
+
+	logerrx("ps_namelen %lu %zu", offsetof(struct ps_msghdr, ps_namelen), sizeof(psm.ps_namelen));
+	logerrx("ps_controllen %lu %zu", offsetof(struct ps_msghdr, ps_controllen), sizeof(psm.ps_controllen));
+	logerrx("ps_pad2 %lu %zu", offsetof(struct ps_msghdr, ps_pad2), sizeof(psm.ps_pad2));
+	logerrx("ps_datalen %lu %zu", offsetof(struct ps_msghdr, ps_datalen), sizeof(psm.ps_datalen));
+	logerrx("psm %zu", sizeof(psm));
+#endif
+
 	return ps_sendpsmmsg(ctx, fd, &psm, msg);
 }
 
diff --git a/src/privsep.h b/src/privsep.h
index ae244e40..11e9fa7b 100644
--- a/src/privsep.h
+++ b/src/privsep.h
@@ -72,6 +72,7 @@
 
 struct ps_addr {
 	sa_family_t psa_family;
+	uint8_t psa_pad[2];
 	union {
 		struct in_addr psau_in_addr;
 		struct in6_addr psau_in6_addr;
@@ -85,6 +86,23 @@ struct ps_id {
 	struct ps_addr psi_addr;
 	unsigned int psi_ifindex;
 	uint8_t psi_cmd;
+	uint8_t psi_pad[3];
+};
+
+struct ps_msghdr {
+	uint8_t ps_cmd;
+	uint8_t ps_pad[sizeof(unsigned long) - 1];
+	unsigned long ps_flags;
+	struct ps_id ps_id;
+	socklen_t ps_namelen;
+	socklen_t ps_controllen;
+	uint8_t ps_pad2[sizeof(size_t) - sizeof(socklen_t)];
+	size_t ps_datalen;
+};
+
+struct ps_msg {
+	struct ps_msghdr psm_hdr;
+	uint8_t psm_data[PS_BUFLEN];
 };
 
 struct ps_process {
@@ -106,21 +124,6 @@ struct ps_process {
 };
 TAILQ_HEAD(ps_process_head, ps_process);
 
-struct ps_msghdr {
-	uint8_t ps_cmd;
-	uint8_t ps_pad[sizeof(unsigned long) - 1];
-	unsigned long ps_flags;
-	struct ps_id ps_id;
-	size_t ps_datalen;
-	socklen_t ps_namelen;
-	socklen_t ps_controllen;
-};
-
-struct ps_msg {
-	struct ps_msghdr psm_hdr;
-	uint8_t psm_data[PS_BUFLEN];
-};
-
 #include "privsep-inet.h"
 #include "privsep-root.h"
 #ifdef INET