Correct CMSG_SPACE and CMSG_LEN usage everywhere in the tree. Due to

an extensive discussion with otto, kettenis, millert, and hshoexer

28 files changed, 272 insertions, 173 deletions

diff --git a/kerberosV/src/kcm/connect.c b/kerberosV/src/kcm/connect.c
index 981d5ac1785..739e2b13871 100644
--- a/kerberosV/src/kcm/connect.c
+++ b/kerberosV/src/kcm/connect.c
@@ -173,7 +173,8 @@ update_client_creds(int s, kcm_client *peer)
 	}	
 	
 	cmp = CMSG_FIRSTHDR(&msg);
-	if (cmp->cmsg_level != SOL_SOCKET || cmp->cmsg_type != SCM_CREDS) {
+	if (cmp->cmsg_level != SOL_SOCKET || cmp->cmsg_type != SCM_CREDS ||
+	    cmp->cmsg_len != CMSG_LEN(sizeof(struct sockcred))) {
 	    free(crmsg);
 	    goto failed_scm_creds;
 	}	
diff --git a/lib/libc/gen/auth_subr.c b/lib/libc/gen/auth_subr.c
index c3a77c58dfe..0f4457e7bc1 100644
--- a/lib/libc/gen/auth_subr.c
+++ b/lib/libc/gen/auth_subr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: auth_subr.c,v 1.32 2007/11/01 00:55:20 millert Exp $	*/
+/*	$OpenBSD: auth_subr.c,v 1.33 2008/03/13 01:49:52 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2000-2002,2004 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -988,11 +988,14 @@ _recv_fd(auth_session_t *as, int fd)
 {
 	struct msghdr msg;
 	struct cmsghdr *cmp;
-	char cmsgbuf[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 
 	memset(&msg, 0, sizeof(msg));
-	msg.msg_control = cmsgbuf;
-	msg.msg_controllen = sizeof(cmsgbuf);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 	if (recvmsg(fd, &msg, 0) < 0)
 		syslog(LOG_ERR, "recvmsg: %m");
 	else if (msg.msg_flags & MSG_TRUNC)
diff --git a/libexec/ftpd/monitor_fdpass.c b/libexec/ftpd/monitor_fdpass.c
index 8047cd957c2..cc3d33d380d 100644
--- a/libexec/ftpd/monitor_fdpass.c
+++ b/libexec/ftpd/monitor_fdpass.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: monitor_fdpass.c,v 1.1 2004/11/28 18:49:30 henning Exp $	*/
+/*	$OpenBSD: monitor_fdpass.c,v 1.2 2008/03/13 01:49:52 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2002 Matthieu Herrb
@@ -31,7 +31,10 @@ void
 send_fd(int sock, int fd)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	int result = 0;
@@ -40,8 +43,8 @@ send_fd(int sock, int fd)
 	memset(&msg, 0, sizeof(msg));
 
 	if (fd >= 0) {
-		msg.msg_control = (caddr_t)tmp;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
@@ -66,7 +69,10 @@ int
 recv_fd(int sock)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	ssize_t n;
@@ -78,8 +84,8 @@ recv_fd(int sock)
 	vec.iov_len = sizeof(int);
 	msg.msg_iov = &vec;
 	msg.msg_iovlen = 1;
-	msg.msg_control = tmp;
-	msg.msg_controllen = sizeof(tmp);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(sock, &msg, 0)) == -1)
 		syslog(LOG_WARNING, "recv_fd: recvmsg(%d): %m", sock);
diff --git a/libexec/login_skey/login_skey.c b/libexec/login_skey/login_skey.c
index 0adea84540f..9a036c72e88 100644
--- a/libexec/login_skey/login_skey.c
+++ b/libexec/login_skey/login_skey.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: login_skey.c,v 1.19 2007/07/26 17:48:41 millert Exp $	*/
+/*	$OpenBSD: login_skey.c,v 1.20 2008/03/13 01:49:52 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2000, 2001, 2004 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -263,11 +263,14 @@ send_fd(int sock)
 {
 	struct msghdr msg;
 	struct cmsghdr *cmp;
-	char cmsgbuf[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 
 	memset(&msg, 0, sizeof(msg));
-	msg.msg_control = cmsgbuf;
-	msg.msg_controllen = CMSG_LEN(sizeof(int));
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	cmp = CMSG_FIRSTHDR(&msg);
 	cmp->cmsg_len = CMSG_LEN(sizeof(int));
diff --git a/libexec/login_tis/login_tis.c b/libexec/login_tis/login_tis.c
index fafdb390ac0..ca436dd5897 100644
--- a/libexec/login_tis/login_tis.c
+++ b/libexec/login_tis/login_tis.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: login_tis.c,v 1.6 2007/07/26 17:48:41 millert Exp $	*/
+/*	$OpenBSD: login_tis.c,v 1.7 2008/03/13 01:49:52 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2004 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -289,11 +289,14 @@ send_fd(struct tis_connection *tc, int sock)
 {
 	struct msghdr msg;
 	struct cmsghdr *cmp;
-	char cmsgbuf[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 
 	memset(&msg, 0, sizeof(msg));
-	msg.msg_control = cmsgbuf;
-	msg.msg_controllen = CMSG_LEN(sizeof(int));
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	cmp = CMSG_FIRSTHDR(&msg);
 	cmp->cmsg_len = CMSG_LEN(sizeof(int));
diff --git a/libexec/tftp-proxy/tftp-proxy.c b/libexec/tftp-proxy/tftp-proxy.c
index 18d3323e911..372731b1c3d 100644
--- a/libexec/tftp-proxy/tftp-proxy.c
+++ b/libexec/tftp-proxy/tftp-proxy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tftp-proxy.c,v 1.2 2006/12/20 03:33:38 joel Exp $
+/* $OpenBSD: tftp-proxy.c,v 1.3 2008/03/13 01:49:52 deraadt Exp $
  *
  * Copyright (c) 2005 DLS Internet Services
  * Copyright (c) 2004, 2005 Camiel Dobbelaar, <cd@sentia.nl>
@@ -75,8 +75,10 @@ main(int argc, char *argv[])
 	char *p;
 	struct tftphdr *tp;
 	struct passwd *pw;
-
-	char cbuf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
+	} cmsgbuf;
 	char req[PKTSIZE];
 	struct cmsghdr *cmsg;
 	struct msghdr msg;
@@ -161,8 +163,8 @@ main(int argc, char *argv[])
 	msg.msg_namelen = sizeof(from);
 	msg.msg_iov = &iov;
 	msg.msg_iovlen = 1;
-	msg.msg_control = cbuf;
-	msg.msg_controllen = CMSG_LEN(sizeof(struct sockaddr_storage));
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if (recvmsg(fd, &msg, 0) < 0) {
 		syslog(LOG_ERR, "recvmsg: %m");
diff --git a/libexec/tftpd/tftpd.c b/libexec/tftpd/tftpd.c
index 337e7123aed..b22b3f48d60 100644
--- a/libexec/tftpd/tftpd.c
+++ b/libexec/tftpd/tftpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tftpd.c,v 1.59 2007/11/29 11:38:46 jmc Exp $	*/
+/*	$OpenBSD: tftpd.c,v 1.60 2008/03/13 01:49:52 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1983 Regents of the University of California.
@@ -37,7 +37,7 @@ char copyright[] =
 
 #ifndef lint
 /*static char sccsid[] = "from: @(#)tftpd.c	5.13 (Berkeley) 2/26/91";*/
-static char rcsid[] = "$OpenBSD: tftpd.c,v 1.59 2007/11/29 11:38:46 jmc Exp $";
+static char rcsid[] = "$OpenBSD: tftpd.c,v 1.60 2008/03/13 01:49:52 deraadt Exp $";
 #endif /* not lint */
 
 /*
@@ -167,7 +167,10 @@ main(int argc, char *argv[])
 	int		 n = 0, on = 1, fd = 0, i, c, dobind = 1;
 	struct tftphdr	*tp;
 	struct passwd	*pw;
-	char		 cbuf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
+	union {
+		struct cmsghdr hdr;
+		char	buf[CMSG_SPACE(sizeof(struct sockaddr_storage))];
+	} cmsgbuf;
 	struct cmsghdr	*cmsg;
 	struct msghdr	 msg;
 	struct iovec	 iov;
@@ -282,8 +285,8 @@ main(int argc, char *argv[])
 	msg.msg_namelen = sizeof(from);
 	msg.msg_iov = &iov;
 	msg.msg_iovlen = 1;
-	msg.msg_control = cbuf;
-	msg.msg_controllen = CMSG_LEN(sizeof(struct sockaddr_storage));
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	n = recvmsg(fd, &msg, 0);
 	if (n < 0) {
@@ -326,9 +329,8 @@ main(int argc, char *argv[])
 			msg.msg_namelen = sizeof(from);
 			msg.msg_iov = &iov;
 			msg.msg_iovlen = 1;
-			msg.msg_control = cbuf;
-			msg.msg_controllen =
-			    CMSG_LEN(sizeof(struct sockaddr_storage));
+			msg.msg_control = &cmsgbuf.buf;
+			msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 			i = recvmsg(fd, &msg, 0);
 			if (i > 0)
diff --git a/regress/sys/kern/unfdpass/unfdpass.c b/regress/sys/kern/unfdpass/unfdpass.c
index 75bb0b3fa00..b695b227446 100644
--- a/regress/sys/kern/unfdpass/unfdpass.c
+++ b/regress/sys/kern/unfdpass/unfdpass.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: unfdpass.c,v 1.12 2004/08/30 18:13:14 millert Exp $	*/
+/*	$OpenBSD: unfdpass.c,v 1.13 2008/03/13 01:49:53 deraadt Exp $	*/
 /*	$NetBSD: unfdpass.c,v 1.3 1998/06/24 23:51:30 thorpej Exp $	*/
 
 /*-
@@ -74,7 +74,10 @@ main(int argc, char *argv[])
 	struct sockaddr_un sun, csun;
 	int csunlen;
 	pid_t pid;
-	char message[CMSG_SPACE(sizeof(int) * 2)];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int) * 2)];
+	} cmsgbuf;
 	int pflag;
 	extern char *__progname;
 
@@ -169,8 +172,8 @@ main(int argc, char *argv[])
 	 * Grab the descriptors passed to us.
 	 */
 	(void) memset(&msg, 0, sizeof(msg));
-	msg.msg_control = message;
-	msg.msg_controllen = CMSG_LEN(sizeof(int) * 2);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if (recvmsg(sock, &msg, 0) < 0)
 		err(1, "recvmsg");
@@ -243,7 +246,10 @@ child(int sock)
 	struct cmsghdr *cmp;
 	int i, fd;
 	struct sockaddr_un sun;
-	char cmsgbuf[CMSG_SPACE(sizeof(int) * 2)];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int) * 2)];
+	} cmsgbuf;
 	int *files;
 
 	/*
@@ -263,8 +269,8 @@ child(int sock)
 	}
 
 	(void) memset(&msg, 0, sizeof(msg));
-	msg.msg_control = cmsgbuf;
-	msg.msg_controllen = CMSG_LEN(sizeof(int) * 2);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	cmp = CMSG_FIRSTHDR(&msg);
 	cmp->cmsg_len = CMSG_LEN(sizeof(int) * 2);
diff --git a/sbin/isakmpd/monitor_fdpass.c b/sbin/isakmpd/monitor_fdpass.c
index 2ead0b48896..aef0e998bd8 100644
--- a/sbin/isakmpd/monitor_fdpass.c
+++ b/sbin/isakmpd/monitor_fdpass.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: monitor_fdpass.c,v 1.13 2008/03/02 18:47:29 hshoexer Exp $	*/
+/*	$OpenBSD: monitor_fdpass.c,v 1.14 2008/03/13 01:49:52 deraadt Exp $	*/
 
 /*
  * Copyright 2001 Niels Provos <provos@citi.umich.edu>
@@ -41,16 +41,16 @@ mm_send_fd(int socket, int fd)
 	struct msghdr   msg;
 	union {
 		struct cmsghdr hdr;
-		char tmp[CMSG_SPACE(sizeof(int))];
-	} tmp;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	char		ch = '\0';
 	struct cmsghdr *cmsg;
 	struct iovec    vec;
 	ssize_t         n;
 
 	bzero(&msg, sizeof msg);
-	msg.msg_control = (caddr_t)&tmp;
-	msg.msg_controllen = CMSG_LEN(sizeof(int));
+	msg.msg_control = (caddr_t)&cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 	cmsg = CMSG_FIRSTHDR(&msg);
 	cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 	cmsg->cmsg_level = SOL_SOCKET;
@@ -80,8 +80,8 @@ mm_receive_fd(int socket)
 	struct msghdr   msg;
 	union {
 		struct cmsghdr hdr;
-		char tmp[CMSG_SPACE(sizeof(int))];
-	} tmp;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	char		ch;
 	struct cmsghdr *cmsg;
 	struct iovec    vec;
@@ -93,8 +93,8 @@ mm_receive_fd(int socket)
 	vec.iov_len = 1;
 	msg.msg_iov = &vec;
 	msg.msg_iovlen = 1;
-	msg.msg_control = &tmp;
-	msg.msg_controllen = sizeof tmp;
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(socket, &msg, 0)) == -1) {
 		log_error("mm_receive_fd: recvmsg");
diff --git a/sbin/mount_portal/activate.c b/sbin/mount_portal/activate.c
index 636592df280..a3b1ed157ed 100644
--- a/sbin/mount_portal/activate.c
+++ b/sbin/mount_portal/activate.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: activate.c,v 1.6 2003/06/11 06:22:14 deraadt Exp $	*/
+/*	$OpenBSD: activate.c,v 1.7 2008/03/13 01:49:52 deraadt Exp $	*/
 /*	$NetBSD: activate.c,v 1.5 1995/04/23 10:33:18 cgd Exp $	*/
 
 /*
@@ -103,10 +103,11 @@ send_reply(int so, int fd, int error)
 	int n;
 	struct iovec iov;
 	struct msghdr msg;
+	struct cmsghdr *cmsg;
 	struct {
 		struct cmsghdr cmsg;
-		int fd;
-	} ctl;
+		u_char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 
 	/*
 	 * Line up error code.  Don't worry about byte ordering
@@ -127,12 +128,13 @@ send_reply(int so, int fd, int error)
 	 * construct a suitable rights control message.
 	 */
 	if (fd >= 0) {
-		ctl.fd = fd;
-		ctl.cmsg.cmsg_len = sizeof(ctl);
-		ctl.cmsg.cmsg_level = SOL_SOCKET;
-		ctl.cmsg.cmsg_type = SCM_RIGHTS;
-		msg.msg_control = (caddr_t)&ctl;
-		msg.msg_controllen = ctl.cmsg.cmsg_len;
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
+		cmsg = CMSG_FIRSTHDR(&msg);
+		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+		cmsg->cmsg_level = SOL_SOCKET;
+		cmsg->cmsg_type = SCM_RIGHTS;
+		*(int *)CMSG_DATA(cmsg) = fd;
 	}
 
 	/*
diff --git a/sbin/pflogd/privsep_fdpass.c b/sbin/pflogd/privsep_fdpass.c
index 50afdfc2859..f6e23dfe031 100644
--- a/sbin/pflogd/privsep_fdpass.c
+++ b/sbin/pflogd/privsep_fdpass.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: privsep_fdpass.c,v 1.2 2004/08/13 02:51:48 djm Exp $	*/
+/*	$OpenBSD: privsep_fdpass.c,v 1.3 2008/03/13 01:49:53 deraadt Exp $	*/
 
 /*
  * Copyright 2001 Niels Provos <provos@citi.umich.edu>
@@ -50,7 +50,10 @@ void
 send_fd(int sock, int fd)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	int result = 0;
@@ -59,8 +62,8 @@ send_fd(int sock, int fd)
 	memset(&msg, 0, sizeof(msg));
 
 	if (fd >= 0) {
-		msg.msg_control = (caddr_t)tmp;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
@@ -86,7 +89,10 @@ int
 receive_fd(int sock)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	ssize_t n;
@@ -98,8 +104,8 @@ receive_fd(int sock)
 	vec.iov_len = sizeof(int);
 	msg.msg_iov = &vec;
 	msg.msg_iovlen = 1;
-	msg.msg_control = tmp;
-	msg.msg_controllen = sizeof(tmp);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(sock, &msg, 0)) == -1)
 		warn("%s: recvmsg", __func__);
diff --git a/sbin/ping6/ping6.c b/sbin/ping6/ping6.c
index d222d27b1c7..005b6a0b1b7 100644
--- a/sbin/ping6/ping6.c
+++ b/sbin/ping6/ping6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ping6.c,v 1.70 2007/12/30 13:38:47 sobrado Exp $	*/
+/*	$OpenBSD: ping6.c,v 1.71 2008/03/13 01:49:53 deraadt Exp $	*/
 /*	$KAME: ping6.c,v 1.163 2002/10/25 02:19:06 itojun Exp $	*/
 
 /*
@@ -873,7 +873,10 @@ main(int argc, char *argv[])
 
 	for (;;) {
 		struct msghdr m;
-		u_char buf[1024];
+		union {
+			struct cmsghdr hdr;
+			u_char buf[sizeof(struct in6_pktinfo)];
+		} cmsgbuf;
 		struct iovec iov[2];
 
 		/* signal handling */
@@ -919,8 +922,8 @@ main(int argc, char *argv[])
 		iov[0].iov_len = packlen;
 		m.msg_iov = iov;
 		m.msg_iovlen = 1;
-		m.msg_control = (caddr_t)buf;
-		m.msg_controllen = sizeof(buf);
+		m.msg_control = (caddr_t)&cmsgbuf.buf;
+		m.msg_controllen = sizeof(cmsgbuf.buf);
 
 		cc = recvmsg(s, &m, 0);
 		if (cc < 0) {
diff --git a/share/man/man3/CMSG_DATA.3 b/share/man/man3/CMSG_DATA.3
index e28080ec33a..7285c8e62e7 100644
--- a/share/man/man3/CMSG_DATA.3
+++ b/share/man/man3/CMSG_DATA.3
@@ -1,7 +1,7 @@
-.\"	$OpenBSD: CMSG_DATA.3,v 1.2 2007/05/31 19:19:48 jmc Exp $
+.\"	$OpenBSD: CMSG_DATA.3,v 1.3 2008/03/13 01:49:53 deraadt Exp $
 .\" Written by Jared Yanovich <jaredy@openbsd.org>
 .\" Public domain, July 3, 2005
-.Dd $Mdocdate: May 31 2007 $
+.Dd $Mdocdate: March 13 2008 $
 .Dt CMSG_DATA 3
 .Os
 .Sh NAME
@@ -61,6 +61,8 @@ This routine determines the size in bytes of a control message,
 which includes the control message header.
 .Fa len
 specifies the length of the data held by the control message.
+This value is what is normally stored in
+.Fa cmsg_len .
 This routine accounts for any alignment constraints on the beginning of
 ancillary data.
 .It Fn CMSG_NXTHDR mhdr cmsg
@@ -77,6 +79,8 @@ This routine determines the size in bytes needed to hold a control
 message and its contents of length
 .Fa len ,
 which includes the control message header.
+This value is what is normally stored in
+.Fa msg_msgcontrollen .
 This routine accounts for any alignment constraints on the beginning of
 ancillary data as well as any needed to pad the next control message.
 .El
@@ -86,11 +90,14 @@ descriptor and passes it over a socket:
 .Bd -literal -offset indent
 struct msghdr	 msg;
 struct cmsghdr	*cmsg;
-unsigned char	 buf[CMSG_SPACE(sizeof(int))];
+union {
+	struct cmsghdr hdr;
+	unsigned char	 buf[CMSG_SPACE(sizeof(int))];
+} cmsgbuf;
 
 memset(&msg, 0, sizeof(msg));
-msg.msg_control = buf;
-msg.msg_controllen = CMSG_LEN(sizeof(int));
+msg.msg_control = &cmsgbuf.buf;
+msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 cmsg = CMSG_FIRSTHDR(&msg);
 cmsg->cmsg_len = CMSG_LEN(sizeof(int));
@@ -106,11 +113,14 @@ And an example that receives and decomposes the control message:
 .Bd -literal -offset indent
 struct msghdr	 msg;
 struct cmsghdr	*cmsg;
-unsigned char	 buf[CMSG_SPACE(sizeof(int))];
+union {
+	struct cmsghdr hdr;
+	unsigned char	 buf[CMSG_SPACE(sizeof(int))];
+} cmsgbuf;
 
 memset(&msg, 0, sizeof(msg));
-msg.msg_control = buf;
-msg.msg_controllen = sizeof(buf);
+msg.msg_control = &cmsgbuf.buf;
+msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 if (recvmsg(s, &msg, 0) == -1)
 	err(1, "recvmsg");
diff --git a/usr.bin/ssh/monitor_fdpass.c b/usr.bin/ssh/monitor_fdpass.c
index 30741a9b3e7..1de4339a7c2 100644
--- a/usr.bin/ssh/monitor_fdpass.c
+++ b/usr.bin/ssh/monitor_fdpass.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_fdpass.c,v 1.14 2008/03/02 18:19:35 deraadt Exp $ */
+/* $OpenBSD: monitor_fdpass.c,v 1.15 2008/03/13 01:49:53 deraadt Exp $ */
 /*
  * Copyright 2001 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -41,16 +41,16 @@ mm_send_fd(int sock, int fd)
 	struct msghdr msg;
 	union {
 		struct cmsghdr hdr;
-		char tmp[CMSG_SPACE(sizeof(int))];
-	} tmp;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	char ch = '\0';
 	ssize_t n;
 
 	memset(&msg, 0, sizeof(msg));
-	msg.msg_control = (caddr_t)&tmp;
-	msg.msg_controllen = CMSG_LEN(sizeof(int));
+	msg.msg_control = (caddr_t)&cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 	cmsg = CMSG_FIRSTHDR(&msg);
 	cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 	cmsg->cmsg_level = SOL_SOCKET;
@@ -81,9 +81,9 @@ mm_receive_fd(int sock)
 {
 	struct msghdr msg;
 	union {
-		char tmp[CMSG_SPACE(sizeof(int))];
 		struct cmsghdr hdr;
-	} tmp;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	ssize_t n;
@@ -95,8 +95,8 @@ mm_receive_fd(int sock)
 	vec.iov_len = 1;
 	msg.msg_iov = &vec;
 	msg.msg_iovlen = 1;
-	msg.msg_control = &tmp;
-	msg.msg_controllen = sizeof(tmp);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(sock, &msg, 0)) == -1) {
 		error("%s: recvmsg: %s", __func__, strerror(errno));
diff --git a/usr.sbin/bgpd/buffer.c b/usr.sbin/bgpd/buffer.c
index e3c56e494f5..f9a33dc9076 100644
--- a/usr.sbin/bgpd/buffer.c
+++ b/usr.sbin/bgpd/buffer.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: buffer.c,v 1.36 2006/09/19 13:04:01 henning Exp $ */
+/*	$OpenBSD: buffer.c,v 1.37 2008/03/13 01:49:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -156,7 +156,10 @@ msgbuf_write(struct msgbuf *msgbuf)
 	ssize_t		 n;
 	struct msghdr	 msg;
 	struct cmsghdr	*cmsg;
-	char		 cmsgbuf[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char	buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 
 	bzero(&iov, sizeof(iov));
 	bzero(&msg, sizeof(msg));
@@ -174,8 +177,8 @@ msgbuf_write(struct msgbuf *msgbuf)
 	msg.msg_iovlen = i;
 
 	if (buf != NULL && buf->fd != -1) {
-		msg.msg_control = (caddr_t)cmsgbuf;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
diff --git a/usr.sbin/bgpd/imsg.c b/usr.sbin/bgpd/imsg.c
index 5e2e225794a..a939876e637 100644
--- a/usr.sbin/bgpd/imsg.c
+++ b/usr.sbin/bgpd/imsg.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg.c,v 1.39 2007/03/19 10:03:25 henning Exp $ */
+/*	$OpenBSD: imsg.c,v 1.40 2008/03/13 01:49:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -42,7 +42,10 @@ imsg_read(struct imsgbuf *ibuf)
 {
 	struct msghdr		 msg;
 	struct cmsghdr		*cmsg;
-	char			 cmsgbuf[CMSG_SPACE(sizeof(int) * 16)];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int) * 16)];
+	} cmsgbuf;
 	struct iovec		 iov;
 	ssize_t			 n;
 	int			 fd;
@@ -53,8 +56,8 @@ imsg_read(struct imsgbuf *ibuf)
 	iov.iov_len = sizeof(ibuf->r.buf) - ibuf->r.wpos;
 	msg.msg_iov = &iov;
 	msg.msg_iovlen = 1;
-	msg.msg_control = cmsgbuf;
-	msg.msg_controllen = sizeof(cmsgbuf);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(ibuf->fd, &msg, 0)) == -1) {
 		if (errno != EINTR && errno != EAGAIN) {
diff --git a/usr.sbin/bind/lib/isc/unix/privsep_fdpass.c b/usr.sbin/bind/lib/isc/unix/privsep_fdpass.c
index 65f18fc8775..dc3ebda4b5d 100644
--- a/usr.sbin/bind/lib/isc/unix/privsep_fdpass.c
+++ b/usr.sbin/bind/lib/isc/unix/privsep_fdpass.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: privsep_fdpass.c,v 1.4 2004/09/28 17:14:07 jakob Exp $	*/
+/*	$OpenBSD: privsep_fdpass.c,v 1.5 2008/03/13 01:49:53 deraadt Exp $	*/
 
 /*
  * Copyright 2001 Niels Provos <provos@citi.umich.edu>
@@ -48,7 +48,10 @@ void
 send_fd(int sock, int fd)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	int result = 0;
@@ -57,8 +60,8 @@ send_fd(int sock, int fd)
 	memset(&msg, 0, sizeof(msg));
 
 	if (fd >= 0) {
-		msg.msg_control = (caddr_t)tmp;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
@@ -83,7 +86,10 @@ int
 receive_fd(int sock)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	ssize_t n;
@@ -95,8 +101,8 @@ receive_fd(int sock)
 	vec.iov_len = sizeof(int);
 	msg.msg_iov = &vec;
 	msg.msg_iovlen = 1;
-	msg.msg_control = tmp;
-	msg.msg_controllen = sizeof(tmp);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(sock, &msg, 0)) == -1)
 		warn("%s: recvmsg", __func__);
diff --git a/usr.sbin/ospf6d/packet.c b/usr.sbin/ospf6d/packet.c
index 2f549e82466..96058ebfe52 100644
--- a/usr.sbin/ospf6d/packet.c
+++ b/usr.sbin/ospf6d/packet.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: packet.c,v 1.6 2007/12/13 08:54:05 claudio Exp $ */
+/*	$OpenBSD: packet.c,v 1.7 2008/03/13 01:49:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2004, 2005 Esben Norby <norby@openbsd.org>
@@ -116,7 +116,10 @@ send_packet(struct iface *iface, void *pkt, size_t len,
 void
 recv_packet(int fd, short event, void *bula)
 {
-	char			 cbuf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
+	union {
+		struct cmsghdr hdr;
+		char	buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
+	} cmsgbuf;
 	struct msghdr		 msg;
 	struct iovec		 iov;
 	struct in6_addr		 addr, dest;
@@ -143,8 +146,8 @@ recv_packet(int fd, short event, void *bula)
 	msg.msg_namelen = sizeof(src);
 	msg.msg_iov = &iov;
 	msg.msg_iovlen = 1;
-	msg.msg_control = cbuf;
-	msg.msg_controllen = sizeof(cbuf);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((r = recvmsg(fd, &msg, 0)) == -1) {
 		if (errno != EAGAIN && errno != EINTR)
diff --git a/usr.sbin/ospfd/packet.c b/usr.sbin/ospfd/packet.c
index 2f6ac3438b9..1f63836f7dc 100644
--- a/usr.sbin/ospfd/packet.c
+++ b/usr.sbin/ospfd/packet.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: packet.c,v 1.22 2006/11/17 08:55:31 claudio Exp $ */
+/*	$OpenBSD: packet.c,v 1.23 2008/03/13 01:49:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2004, 2005 Esben Norby <norby@openbsd.org>
@@ -111,7 +111,10 @@ send_packet(struct iface *iface, void *pkt, size_t len, struct sockaddr_in *dst)
 void
 recv_packet(int fd, short event, void *bula)
 {
-	char			 cbuf[CMSG_SPACE(sizeof(struct sockaddr_dl))];
+	union {
+		struct cmsghdr hdr;
+		char	buf[CMSG_SPACE(sizeof(struct sockaddr_dl))];
+	} cmsgbuf;
 	struct msghdr		 msg;
 	struct iovec		 iov;
 	struct ip		 ip_hdr;
@@ -136,8 +139,8 @@ recv_packet(int fd, short event, void *bula)
 	iov.iov_len = READ_BUF_SIZE;
 	msg.msg_iov = &iov;
 	msg.msg_iovlen = 1;
-	msg.msg_control = cbuf;
-	msg.msg_controllen = sizeof(cbuf);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((r = recvmsg(fd, &msg, 0)) == -1) {
 		if (errno != EAGAIN && errno != EINTR)
diff --git a/usr.sbin/ppp/ppp/bundle.c b/usr.sbin/ppp/ppp/bundle.c
index 19b6639c6ba..17fad31be59 100644
--- a/usr.sbin/ppp/ppp/bundle.c
+++ b/usr.sbin/ppp/ppp/bundle.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$OpenBSD: bundle.c,v 1.71 2005/09/21 15:04:28 brad Exp $
+ *	$OpenBSD: bundle.c,v 1.72 2008/03/13 01:49:53 deraadt Exp $
  */
 
 #include <sys/param.h>
@@ -1376,7 +1376,10 @@ bundle_LinkSize()
 void
 bundle_ReceiveDatalink(struct bundle *bundle, int s)
 {
-  char cmsgbuf[sizeof(struct cmsghdr) + sizeof(int) * SEND_MAXFD];
+  union {
+    struct cmsghdr hdr;
+    char buf[sizeof(struct cmsghdr) + sizeof(int) * SEND_MAXFD];
+  } cmsgbuf;
   int niov, expect, f, *fd, nfd, onfd, got;
   struct iovec iov[SCATTER_SEGMENTS];
   struct cmsghdr *cmsg;
@@ -1409,19 +1412,17 @@ bundle_ReceiveDatalink(struct bundle *bundle, int s)
       expect += iov[f].iov_len;
   }
 
-  /* Set up our message */
-  cmsg = (struct cmsghdr *)cmsgbuf;
-  cmsg->cmsg_len = sizeof cmsgbuf;
-  cmsg->cmsg_level = SOL_SOCKET;
-  cmsg->cmsg_type = 0;
-
   memset(&msg, '\0', sizeof msg);
   msg.msg_name = NULL;
   msg.msg_namelen = 0;
   msg.msg_iov = iov;
   msg.msg_iovlen = 1;		/* Only send the version at the first pass */
-  msg.msg_control = cmsgbuf;
-  msg.msg_controllen = sizeof cmsgbuf;
+  msg.msg_control = cmsgbuf.buf;
+  msg.msg_controllen = sizeof cmsgbuf.buf;
+  cmsg = CMSG_FIRSTHDR(&msg);
+  cmsg->cmsg_len = sizeof cmsgbuf.buf;
+  cmsg->cmsg_level = SOL_SOCKET;
+  cmsg->cmsg_type = 0;
 
   log_Printf(LogDEBUG, "Expecting %u scatter/gather bytes\n",
              (unsigned)iov[0].iov_len);
@@ -1537,7 +1538,10 @@ bundle_ReceiveDatalink(struct bundle *bundle, int s)
 void
 bundle_SendDatalink(struct datalink *dl, int s, struct sockaddr_un *sun)
 {
-  char cmsgbuf[CMSG_SPACE(sizeof(int) * SEND_MAXFD)];
+  union {
+    struct cmsghdr hdr;
+    char buf[CMSG_SPACE(sizeof(int) * SEND_MAXFD)];
+  } cmsgbuf;
   const char *constlock;
   char *lock;
   struct cmsghdr *cmsg;
@@ -1586,11 +1590,10 @@ bundle_SendDatalink(struct datalink *dl, int s, struct sockaddr_un *sun)
      */
     msg.msg_iovlen = 1;
     msg.msg_iov = iov;
-    msg.msg_control = cmsgbuf;
+    msg.msg_control = &cmsgbuf.buf;
     msg.msg_controllen = CMSG_SPACE(sizeof(int) * nfd);
     msg.msg_flags = 0;
-
-    cmsg = (struct cmsghdr *)cmsgbuf;
+    cmsg = CMSG_FIRSTHDR(&msg);
     cmsg->cmsg_len = msg.msg_controllen;
     cmsg->cmsg_level = SOL_SOCKET;
     cmsg->cmsg_type = SCM_RIGHTS;
diff --git a/usr.sbin/relayd/buffer.c b/usr.sbin/relayd/buffer.c
index 81f4b58d86a..31de258f42f 100644
--- a/usr.sbin/relayd/buffer.c
+++ b/usr.sbin/relayd/buffer.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: buffer.c,v 1.9 2007/12/07 17:17:00 reyk Exp $	*/
+/*	$OpenBSD: buffer.c,v 1.10 2008/03/13 01:49:53 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -159,7 +159,10 @@ msgbuf_write(struct msgbuf *msgbuf)
 	ssize_t		 n;
 	struct msghdr	 msg;
 	struct cmsghdr	*cmsg;
-	char		 cmsgbuf[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char	buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 
 	bzero(&iov, sizeof(iov));
 	bzero(&msg, sizeof(msg));
@@ -177,8 +180,8 @@ msgbuf_write(struct msgbuf *msgbuf)
 	msg.msg_iovlen = i;
 
 	if (buf != NULL && buf->fd != -1) {
-		msg.msg_control = (caddr_t)cmsgbuf;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
@@ -200,8 +203,8 @@ msgbuf_write(struct msgbuf *msgbuf)
 	}
 
 	if (buf != NULL && buf->fd != -1) {
-		msg.msg_control = (caddr_t)cmsgbuf;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
diff --git a/usr.sbin/relayd/imsg.c b/usr.sbin/relayd/imsg.c
index 1583160cf3f..5915b1fcdb3 100644
--- a/usr.sbin/relayd/imsg.c
+++ b/usr.sbin/relayd/imsg.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg.c,v 1.11 2008/02/11 10:42:50 reyk Exp $	*/
+/*	$OpenBSD: imsg.c,v 1.12 2008/03/13 01:49:53 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -52,7 +52,10 @@ imsg_read(struct imsgbuf *ibuf)
 {
 	struct msghdr		 msg;
 	struct cmsghdr		*cmsg;
-	char			 cmsgbuf[CMSG_SPACE(sizeof(int) * 16)];
+	union {
+		struct cmsghdr hdr;
+		char	buf[CMSG_SPACE(sizeof(int) * 16)];
+	} cmsgbuf;
 	struct iovec		 iov;
 	ssize_t			 n;
 	int			 fd;
@@ -64,8 +67,8 @@ imsg_read(struct imsgbuf *ibuf)
 	iov.iov_len = sizeof(ibuf->r.buf) - ibuf->r.wpos;
 	msg.msg_iov = &iov;
 	msg.msg_iovlen = 1;
-	msg.msg_control = cmsgbuf;
-	msg.msg_controllen = sizeof(cmsgbuf);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(ibuf->fd, &msg, 0)) == -1) {
 		if (errno != EINTR && errno != EAGAIN) {
diff --git a/usr.sbin/ripd/packet.c b/usr.sbin/ripd/packet.c
index b2f6e0d43a6..e314cbadeab 100644
--- a/usr.sbin/ripd/packet.c
+++ b/usr.sbin/ripd/packet.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: packet.c,v 1.7 2007/10/24 20:52:50 claudio Exp $ */
+/*	$OpenBSD: packet.c,v 1.8 2008/03/13 01:49:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2006 Michele Marchetto <mydecay@openbeer.it>
@@ -79,7 +79,10 @@ send_packet(struct iface *iface, void *pkt, size_t len, struct sockaddr_in *dst)
 void
 recv_packet(int fd, short event, void *bula)
 {
-	char			 cbuf[CMSG_SPACE(sizeof(struct sockaddr_dl))];
+	union {
+		struct cmsghdr hdr;
+		char	buf[CMSG_SPACE(sizeof(struct sockaddr_dl))];
+	} cmsgbuf;
 	struct sockaddr_in	 src;
 	struct iovec		 iov;
 	struct msghdr		 msg;
@@ -109,8 +112,8 @@ recv_packet(int fd, short event, void *bula)
 	msg.msg_namelen = sizeof(src);
 	msg.msg_iov = &iov;
 	msg.msg_iovlen = 1;
-	msg.msg_control = cbuf;
-	msg.msg_controllen = sizeof(cbuf);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(&cmsgbuf.buf);
 
 	if ((r = recvmsg(fd, &msg, 0)) == -1) {
 		if (errno != EINTR && errno != EAGAIN)
diff --git a/usr.sbin/route6d/route6d.c b/usr.sbin/route6d/route6d.c
index 87109542546..236a0456193 100644
--- a/usr.sbin/route6d/route6d.c
+++ b/usr.sbin/route6d/route6d.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: route6d.c,v 1.48 2007/11/26 09:28:34 martynas Exp $	*/
+/*	$OpenBSD: route6d.c,v 1.49 2008/03/13 01:49:53 deraadt Exp $	*/
 /*	$KAME: route6d.c,v 1.111 2006/10/25 06:38:13 jinmei Exp $	*/
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #if 0
-static char _rcsid[] = "$OpenBSD: route6d.c,v 1.48 2007/11/26 09:28:34 martynas Exp $";
+static char _rcsid[] = "$OpenBSD: route6d.c,v 1.49 2008/03/13 01:49:53 deraadt Exp $";
 #endif
 
 #include <stdio.h>
@@ -932,7 +932,10 @@ sendpacket(struct sockaddr_in6 *sin6, int len)
 	struct msghdr m;
 	struct cmsghdr *cm;
 	struct iovec iov[2];
-	u_char cmsgbuf[256];
+	union {
+		struct cmsghdr hdr;
+		u_char buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
+	} cmsgbuf;
 	struct in6_pktinfo *pi;
 	int idx;
 	struct sockaddr_in6 sincopy;
@@ -960,11 +963,10 @@ sendpacket(struct sockaddr_in6 *sin6, int len)
 		m.msg_control = NULL;
 		m.msg_controllen = 0;
 	} else {
-		memset(cmsgbuf, 0, sizeof(cmsgbuf));
-		cm = (struct cmsghdr *)cmsgbuf;
-		m.msg_control = (caddr_t)cm;
-		m.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
-
+		memset(&cmsgbuf, 0, sizeof(cmsgbuf));
+		m.msg_control = (caddr_t)&cmsgbuf.buf;
+		m.msg_controllen = sizeof(cmsgbuf.buf);
+		cm = CMSG_FIRSTHDR(&m);
 		cm->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
 		cm->cmsg_level = IPPROTO_IPV6;
 		cm->cmsg_type = IPV6_PKTINFO;
@@ -1001,7 +1003,10 @@ riprecv(void)
 	struct msghdr m;
 	struct cmsghdr *cm;
 	struct iovec iov[2];
-	u_char cmsgbuf[256];
+	union {
+		struct cmsghdr hdr;
+		u_char buf[CMSG_LEN(sizeof(struct in6_pktinfo))];
+	} cmsgbuf;
 	struct in6_pktinfo *pi = NULL;
 	int *hlimp = NULL;
 	struct iff *iffp;
@@ -1017,9 +1022,8 @@ riprecv(void)
 	iov[0].iov_len = sizeof(buf);
 	m.msg_iov = iov;
 	m.msg_iovlen = 1;
-	cm = (struct cmsghdr *)cmsgbuf;
-	m.msg_control = (caddr_t)cm;
-	m.msg_controllen = sizeof(cmsgbuf);
+	m.msg_control = (caddr_t)&cmsgbuf.buf;
+	m.msg_controllen = sizeof(cmsgbuf.buf);
 	if ((len = recvmsg(ripsock, &m, 0)) < 0) {
 		fatal("recvmsg");
 		/*NOTREACHED*/
diff --git a/usr.sbin/snmpd/buffer.c b/usr.sbin/snmpd/buffer.c
index c0fc184df46..6882a4addfa 100644
--- a/usr.sbin/snmpd/buffer.c
+++ b/usr.sbin/snmpd/buffer.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: buffer.c,v 1.1 2007/12/05 09:22:44 reyk Exp $	*/
+/*	$OpenBSD: buffer.c,v 1.2 2008/03/13 01:49:53 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -159,7 +159,10 @@ msgbuf_write(struct msgbuf *msgbuf)
 	ssize_t		 n;
 	struct msghdr	 msg;
 	struct cmsghdr	*cmsg;
-	char		 cmsgbuf[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 
 	bzero(&iov, sizeof(iov));
 	bzero(&msg, sizeof(msg));
@@ -177,8 +180,8 @@ msgbuf_write(struct msgbuf *msgbuf)
 	msg.msg_iovlen = i;
 
 	if (buf != NULL && buf->fd != -1) {
-		msg.msg_control = (caddr_t)cmsgbuf;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
@@ -200,8 +203,8 @@ msgbuf_write(struct msgbuf *msgbuf)
 	}
 
 	if (buf != NULL && buf->fd != -1) {
-		msg.msg_control = (caddr_t)cmsgbuf;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
diff --git a/usr.sbin/snmpd/imsg.c b/usr.sbin/snmpd/imsg.c
index 708154602df..10f4c43934d 100644
--- a/usr.sbin/snmpd/imsg.c
+++ b/usr.sbin/snmpd/imsg.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg.c,v 1.2 2008/01/18 02:09:30 reyk Exp $	*/
+/*	$OpenBSD: imsg.c,v 1.3 2008/03/13 01:49:53 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -52,7 +52,10 @@ imsg_read(struct imsgbuf *ibuf)
 {
 	struct msghdr		 msg;
 	struct cmsghdr		*cmsg;
-	char			 cmsgbuf[CMSG_SPACE(sizeof(int) * 16)];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int) * 16)];
+	} cmsgbuf;
 	struct iovec		 iov;
 	ssize_t			 n;
 	int			 fd;
@@ -64,8 +67,8 @@ imsg_read(struct imsgbuf *ibuf)
 	iov.iov_len = sizeof(ibuf->r.buf) - ibuf->r.wpos;
 	msg.msg_iov = &iov;
 	msg.msg_iovlen = 1;
-	msg.msg_control = cmsgbuf;
-	msg.msg_controllen = sizeof(cmsgbuf);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(ibuf->fd, &msg, 0)) == -1) {
 		if (errno != EINTR && errno != EAGAIN) {
diff --git a/usr.sbin/syslogd/privsep_fdpass.c b/usr.sbin/syslogd/privsep_fdpass.c
index 0a4c33b2164..85dc100b88f 100644
--- a/usr.sbin/syslogd/privsep_fdpass.c
+++ b/usr.sbin/syslogd/privsep_fdpass.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: privsep_fdpass.c,v 1.4 2004/09/14 23:41:29 deraadt Exp $	*/
+/*	$OpenBSD: privsep_fdpass.c,v 1.5 2008/03/13 01:49:53 deraadt Exp $	*/
 
 /*
  * Copyright 2001 Niels Provos <provos@citi.umich.edu>
@@ -50,7 +50,10 @@ void
 send_fd(int sock, int fd)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	int result = 0;
@@ -59,8 +62,8 @@ send_fd(int sock, int fd)
 	memset(&msg, 0, sizeof(msg));
 
 	if (fd >= 0) {
-		msg.msg_control = (caddr_t)tmp;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
@@ -86,7 +89,10 @@ int
 receive_fd(int sock)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	ssize_t n;
@@ -98,8 +104,8 @@ receive_fd(int sock)
 	vec.iov_len = sizeof(int);
 	msg.msg_iov = &vec;
 	msg.msg_iovlen = 1;
-	msg.msg_control = tmp;
-	msg.msg_controllen = sizeof(tmp);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(sock, &msg, 0)) == -1)
 		warn("%s: recvmsg", "receive_fd");
diff --git a/usr.sbin/tcpdump/privsep_fdpass.c b/usr.sbin/tcpdump/privsep_fdpass.c
index bfb3d46e671..8dde85d5c9d 100644
--- a/usr.sbin/tcpdump/privsep_fdpass.c
+++ b/usr.sbin/tcpdump/privsep_fdpass.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: privsep_fdpass.c,v 1.4 2004/08/13 02:51:48 djm Exp $	*/
+/*	$OpenBSD: privsep_fdpass.c,v 1.5 2008/03/13 01:49:53 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2002 Matthieu Herrb
@@ -33,7 +33,10 @@ void
 send_fd(int sock, int fd)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	int result = 0;
@@ -42,8 +45,8 @@ send_fd(int sock, int fd)
 	memset(&msg, 0, sizeof(msg));
 
 	if (fd >= 0) {
-		msg.msg_control = (caddr_t)tmp;
-		msg.msg_controllen = CMSG_LEN(sizeof(int));
+		msg.msg_control = (caddr_t)&cmsgbuf.buf;
+		msg.msg_controllen = sizeof(cmsgbuf.buf);
 		cmsg = CMSG_FIRSTHDR(&msg);
 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 		cmsg->cmsg_level = SOL_SOCKET;
@@ -68,7 +71,10 @@ int
 receive_fd(int sock)
 {
 	struct msghdr msg;
-	char tmp[CMSG_SPACE(sizeof(int))];
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(int))];
+	} cmsgbuf;
 	struct cmsghdr *cmsg;
 	struct iovec vec;
 	ssize_t n;
@@ -80,8 +86,8 @@ receive_fd(int sock)
 	vec.iov_len = sizeof(int);
 	msg.msg_iov = &vec;
 	msg.msg_iovlen = 1;
-	msg.msg_control = tmp;
-	msg.msg_controllen = sizeof(tmp);
+	msg.msg_control = &cmsgbuf.buf;
+	msg.msg_controllen = sizeof(cmsgbuf.buf);
 
 	if ((n = recvmsg(sock, &msg, 0)) == -1)
 		warn("%s: recvmsg", __func__);