Skip to content

Integer overflow in `setsockopt()`

There is an integer overflow error in setsockopt() at src/platform/redox/socket.rs:364:26 when program calls setsockopt relibc syscall with large timeval.tv_usec.

https://gitlab.redox-os.org/redox-os/relibc/-/blob/master/src/platform/redox/socket.rs?ref_type=heads#L362-365

To Reproduce

  1. Compile a program which calls system call setsockopt with large tv_usec (i.e., 0x7fffffff)
#include <arpa/inet.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <unistd.h>

int main() {
  int sockfd;
  struct timeval timeout;

  timeout.tv_sec = 5;
  timeout.tv_usec = 0x7fffffff;

  sockfd = socket(AF_INET, SOCK_STREAM, 0);
  setsockopt(sockfd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout));

  return 0;
}
  1. Run the compiled program

Environment

  • Official Podman
  • Intel(R) Xeon(R) Gold 6230R CPU @ 2.10GHz
  • Redox relibc version: main 32fca670

Logs

I add overflow-checks = true for relibc.

user:~# setsockopt
RELIBC PANIC: panicked at src/platform/redox/socket.rs:364:26:
attempt to multiply with overflow