Problem concerns sctp_sendv() function when using SCTP_SENDV_SPA infotype.

[marcellgg]

More precisely, let's consider the following program:

+++++
#include <stddef.h>
#include <string.h>
#include <netinet/in.h>
#include <netinet/sctp.h>
#include <arpa/inet.h>

int
main(void)
{
int sock;
struct sockaddr_in addr;
struct sctp_sendv_spa spa;
struct iovec iov = {
.iov_base = "data",
.iov_len = 4
};
sock = socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP);
addr.sin_family = AF_INET;
addr.sin_port = htons(20000);
addr.sin_addr.s_addr = inet_addr("127.0.0.1");
connect(sock, (struct sockaddr *) &addr, sizeof(addr));
memset(&spa, 0, sizeof(spa));
spa.sendv_flags = SCTP_SEND_SNDINFO_VALID | SCTP_SEND_PRINFO_VALID |
SCTP_SEND_AUTHINFO_VALID;
sctp_sendv(sock, &iov, 1, NULL, 0, &spa, sizeof(spa), SCTP_SENDV_SPA, 0);
return 0;
}
+++++

Compile this program:

$ gcc -Wall e.c -o e -lsctp

If you execute the program, a fatal error is raised:

$ ./e
** stack smashing detected ***: terminated

Important note: this error occurs ONLY if the 3 flags are present in field
sendv_flags. If only one or two (no matter which flag(s)) are present in field
sendv_flags, execution produces no error.

[marceloleitner]

On a quick read, it looks sctp_send needs this patch:

…

--- a/src/lib/sendmsg.c +++ b/src/lib/sendmsg.c @@ -123,9 +123,11 @@ int sctp_sendv(int s, const struct iovec *iov, int iovcnt, struct sockaddr *addrs, int addrcnt, void *info, socklen_t infolen, unsigned int infotype, int flags) { - char _cmsg[CMSG_SPACE(sizeof(struct sctp_sndinfo)) + - CMSG_SPACE(sizeof(struct sctp_prinfo)) + - CMSG_SPACE(sizeof(struct sctp_authinfo))]; +#define MAX(x, y) ((x)>(y)?(x):(y)) +#define MAX3(x, y, z) MAX(MAX(x, y), z) + char _cmsg[MAX3(CMSG_SPACE(sizeof(struct sctp_sndinfo))*3, + CMSG_SPACE(sizeof(struct sctp_prinfo)), + CMSG_SPACE(sizeof(struct sctp_authinfo)))]; struct cmsghdr *cmsg = (struct cmsghdr *)_cmsg; struct msghdr outmsg = {}; struct sockaddr *addr; MAX usage because those 3 structs cannot be used at the same time, and 3* sctp_sndinfo because we can specify those 3 flags together. Xin, any thoughts?

[lxin]

@marceloleitner I'm thinking they're just missing the fix: f6d64dc

@marcellgg
can you please check if this commit is in your lksctp-tools package, or check if it's version >= 1.0.20?

Thanks.

[marcellgg]

@marcellgg <https://github.com/marcellgg> can you please check if this commit is in your lksctp-tools package, or check if it's version >= 1.0.20? Thanks.

Hi, Version of my  lksctp-tools package: 1.0.19+dfsg-2 Yves.

…

Message ID: ***@***.***>