Fix theoretical access to garbage stack memory in pfkey_reply for

bgpd and ldpd.

Found by CodeChecker.

OK claudio@

diff --git a/usr.sbin/bgpd/pfkey.c b/usr.sbin/bgpd/pfkey.c
index 20c684c..7918775 100644 (file)
--- a/usr.sbin/bgpd/pfkey.c
+++ b/usr.sbin/bgpd/pfkey.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: pfkey.c,v 1.67 2022/08/17 15:15:26 claudio Exp $ */
+/*     $OpenBSD: pfkey.c,v 1.68 2022/11/07 22:39:13 mbuhl Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -423,7 +423,7 @@ pfkey_read(int sd, struct sadb_msg *h)
 
        if (recv(sd, &hdr, sizeof(hdr), MSG_PEEK) != sizeof(hdr)) {
                if (errno == EAGAIN || errno == EINTR)
-                       return (0);
+                       return (1);
                log_warn("pfkey peek");
                return (-1);
        }
@@ -439,7 +439,7 @@ pfkey_read(int sd, struct sadb_msg *h)
        /* not ours, discard */
        if (read(sd, &hdr, sizeof(hdr)) == -1) {
                if (errno == EAGAIN || errno == EINTR)
-                       return (0);
+                       return (1);
                log_warn("pfkey read");
                return (-1);
        }

diff --git a/usr.sbin/ldpd/pfkey.c b/usr.sbin/ldpd/pfkey.c
index 0af77a8..0a4a912 100644 (file)
--- a/usr.sbin/ldpd/pfkey.c
+++ b/usr.sbin/ldpd/pfkey.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: pfkey.c,v 1.12 2019/01/23 02:02:04 dlg Exp $ */
+/*     $OpenBSD: pfkey.c,v 1.13 2022/11/07 22:39:13 mbuhl Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -253,7 +253,7 @@ pfkey_read(int sd, struct sadb_msg *h)
 
        if (recv(sd, &hdr, sizeof(hdr), MSG_PEEK) != sizeof(hdr)) {
                if (errno == EAGAIN || errno == EINTR)
-                       return (0);
+                       return (1);
                log_warn("pfkey peek");
                return (-1);
        }
@@ -269,7 +269,7 @@ pfkey_read(int sd, struct sadb_msg *h)
        /* not ours, discard */
        if (read(sd, &hdr, sizeof(hdr)) == -1) {
                if (errno == EAGAIN || errno == EINTR)
-                       return (0);
+                       return (1);
                log_warn("pfkey read");
                return (-1);
        }