internal/socket: don't crash with corrupted control messages
Change-Id: I5c484662add4261f504607758521718f4c760375
Reviewed-on: https://go-review.googlesource.com/45294
TryBot-Result: Gobot Gobot <gobot@golang.org>
Run-TryBot: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
diff --git a/internal/socket/socket.go b/internal/socket/socket.go
index 1eab2fb..729dea1 100644
--- a/internal/socket/socket.go
+++ b/internal/socket/socket.go
@@ -175,6 +175,9 @@
for len(m) >= controlHeaderLen() {
h := (*cmsghdr)(unsafe.Pointer(&m[0]))
l := h.len()
+ if l <= 0 {
+ return nil, errors.New("invalid header length")
+ }
if uint64(l) < uint64(controlHeaderLen()) {
return nil, errors.New("invalid message length")
}
