From 79e90ad1b5a1104114ff54a42186e416bb04f668 Mon Sep 17 00:00:00 2001 From: Andrei Emeltchenko Date: Thu, 7 Nov 2013 17:25:35 +0200 Subject: [PATCH] android/ipc: Fix crash when sending file descriptor Since CMSG_FIRSTHDR is defined as shown below: ((size_t) (mhdr)->msg_controllen >= sizeof (struct cmsghdr) \ ? (struct cmsghdr *) (mhdr)->msg_control : (struct cmsghdr *) 0) it return NULL if msg_controllen is not defined. Accessing that pointer result in daemon crash. --- android/ipc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/android/ipc.c b/android/ipc.c index 9a8657d44..729f15771 100644 --- a/android/ipc.c +++ b/android/ipc.c @@ -62,6 +62,9 @@ void ipc_send(int sk, uint8_t service_id, uint8_t opcode, uint16_t len, msg.msg_iovlen = 2; if (fd >= 0) { + msg.msg_control = cmsgbuf; + msg.msg_controllen = sizeof(cmsgbuf); + cmsg = CMSG_FIRSTHDR(&msg); cmsg->cmsg_level = SOL_SOCKET; cmsg->cmsg_type = SCM_RIGHTS; @@ -69,9 +72,6 @@ void ipc_send(int sk, uint8_t service_id, uint8_t opcode, uint16_t len, /* Initialize the payload */ memcpy(CMSG_DATA(cmsg), &fd, sizeof(int)); - - msg.msg_control = cmsgbuf; - msg.msg_controllen = sizeof(cmsgbuf); } if (sendmsg(sk, &msg, 0) < 0) { -- 2.47.3