From 56d3a905eda615e9629c1dc667f9431ca057daf6 Mon Sep 17 00:00:00 2001 From: Nils Andreas Svee Date: Thu, 7 May 2026 19:02:38 +0700 Subject: [PATCH] fix(client): harden ancillary control message parsing --- crates/irtt-client/src/receive/linux.rs | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/crates/irtt-client/src/receive/linux.rs b/crates/irtt-client/src/receive/linux.rs index 5bf7137..c6e52e0 100644 --- a/crates/irtt-client/src/receive/linux.rs +++ b/crates/irtt-client/src/receive/linux.rs @@ -86,13 +86,16 @@ unsafe fn parse_receive_meta(msg: &libc::msghdr) -> ReceiveMeta { let mut cmsg = libc::CMSG_FIRSTHDR(msg); while !cmsg.is_null() { let cmsg_ref = &*cmsg; - if cmsg_ref.cmsg_len >= libc::CMSG_LEN(0) as usize { - let data_len = cmsg_ref.cmsg_len - libc::CMSG_LEN(0) as usize; - if is_traffic_class_cmsg(cmsg_ref) { - meta.traffic_class = read_int_cmsg_low_byte(cmsg, data_len); - } else if is_kernel_rx_timestamp_cmsg(cmsg_ref) { - meta.kernel_rx_timestamp = read_timespec_cmsg(cmsg, data_len); - } + let header_len = libc::CMSG_LEN(0) as usize; + if cmsg_ref.cmsg_len < header_len { + cmsg = libc::CMSG_NXTHDR(msg, cmsg); + continue; + } + let data_len = cmsg_ref.cmsg_len - header_len; + if is_traffic_class_cmsg(cmsg_ref) { + meta.traffic_class = read_int_cmsg_low_byte(cmsg, data_len); + } else if is_kernel_rx_timestamp_cmsg(cmsg_ref) { + meta.kernel_rx_timestamp = read_timespec_cmsg(cmsg, data_len); } cmsg = libc::CMSG_NXTHDR(msg, cmsg); }