diff options
| -rw-r--r-- | Modules/socketmodule.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c index f56e9af..79ccae8 100644 --- a/Modules/socketmodule.c +++ b/Modules/socketmodule.c @@ -1745,7 +1745,8 @@ cmsg_min_space(struct msghdr *msg, struct cmsghdr *cmsgh, size_t space) static const size_t cmsg_len_end = (offsetof(struct cmsghdr, cmsg_len) + sizeof(cmsgh->cmsg_len)); - if (cmsgh == NULL || msg->msg_control == NULL) + /* Note that POSIX allows msg_controllen to be of signed type. */ + if (cmsgh == NULL || msg->msg_control == NULL || msg->msg_controllen < 0) return 0; if (space < cmsg_len_end) space = cmsg_len_end; |