correct CMSG_SPACE and CMSG_LEN handling as done in other places. These

are the complicated cases where multiple messages are sent.  discussed
with kettenis, hshoexer, and rtsol tested by jmc - thanks

3 files changed, 21 insertions, 11 deletions

diff --git a/usr.sbin/rtadvd/rtadvd.c b/usr.sbin/rtadvd/rtadvd.c
index 0d24cf065cc..1738f3e662b 100644
--- a/usr.sbin/rtadvd/rtadvd.c
+++ b/usr.sbin/rtadvd/rtadvd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtadvd.c,v 1.28 2007/01/10 08:10:47 itojun Exp $	*/
+/*	$OpenBSD: rtadvd.c,v 1.29 2008/03/18 19:32:18 deraadt Exp $	*/
 /*	$KAME: rtadvd.c,v 1.66 2002/05/29 14:18:36 itojun Exp $	*/
 
 /*
@@ -67,8 +67,10 @@
 
 struct msghdr rcvmhdr;
 static u_char *rcvcmsgbuf;
+static size_t rcvcmsgbufspace;
 static size_t rcvcmsgbuflen;
 static u_char *sndcmsgbuf = NULL;
+static size_t sndcmsgbufspace;
 static size_t sndcmsgbuflen;
 volatile sig_atomic_t do_dump;
 volatile sig_atomic_t do_die;
@@ -1295,16 +1297,20 @@ sock_open()
 	static u_char answer[1500];
 
 	rcvcmsgbuflen = CMSG_SPACE(sizeof(struct in6_pktinfo)) +
-				CMSG_SPACE(sizeof(int));
-	rcvcmsgbuf = (u_char *)malloc(rcvcmsgbuflen);
+	    CMSG_LEN(sizeof(int));
+	rcvcmsgbufspace = CMSG_SPACE(sizeof(struct in6_pktinfo)) +
+	    CMSG_SPACE(sizeof(int));
+	rcvcmsgbuf = (u_char *)malloc(rcvcmsgbufspace);
 	if (rcvcmsgbuf == NULL) {
 		syslog(LOG_ERR, "<%s> not enough core", __func__);
 		exit(1);
 	}
 
 	sndcmsgbuflen = CMSG_SPACE(sizeof(struct in6_pktinfo)) + 
-				CMSG_SPACE(sizeof(int));
-	sndcmsgbuf = (u_char *)malloc(sndcmsgbuflen);
+	    CMSG_LEN(sizeof(int));
+	sndcmsgbufspace = CMSG_SPACE(sizeof(struct in6_pktinfo)) + 
+	    CMSG_SPACE(sizeof(int));
+	sndcmsgbuf = (u_char *)malloc(sndcmsgbufspace);
 	if (sndcmsgbuf == NULL) {
 		syslog(LOG_ERR, "<%s> not enough core", __func__);
 		exit(1);
diff --git a/usr.sbin/rtsold/probe.c b/usr.sbin/rtsold/probe.c
index d6b42445863..33720656bc5 100644
--- a/usr.sbin/rtsold/probe.c
+++ b/usr.sbin/rtsold/probe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: probe.c,v 1.10 2003/10/05 15:29:28 deraadt Exp $	*/
+/*	$OpenBSD: probe.c,v 1.11 2008/03/18 19:32:19 deraadt Exp $	*/
 /*	$KAME: probe.c,v 1.16 2002/06/10 20:00:36 itojun Exp $	*/
 
 /*
@@ -64,11 +64,13 @@ int
 probe_init(void)
 {
 	int scmsglen = CMSG_SPACE(sizeof(struct in6_pktinfo)) +
+	    CMSG_LEN(sizeof(int));
+	int scmsgspace = CMSG_SPACE(sizeof(struct in6_pktinfo)) +
 	    CMSG_SPACE(sizeof(int));
 	static u_char *sndcmsgbuf = NULL;
 
 	if (sndcmsgbuf == NULL &&
-	    (sndcmsgbuf = (u_char *)malloc(scmsglen)) == NULL) {
+	    (sndcmsgbuf = (u_char *)malloc(scmsgspace)) == NULL) {
 		warnmsg(LOG_ERR, __func__, "malloc failed");
 		return(-1);
 	}
diff --git a/usr.sbin/rtsold/rtsol.c b/usr.sbin/rtsold/rtsol.c
index eb7b0ee83a9..fe2988826d4 100644
--- a/usr.sbin/rtsold/rtsol.c
+++ b/usr.sbin/rtsold/rtsol.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtsol.c,v 1.12 2007/09/07 14:24:02 jmc Exp $	*/
+/*	$OpenBSD: rtsol.c,v 1.13 2008/03/18 19:32:19 deraadt Exp $	*/
 /*	$KAME: rtsol.c,v 1.15 2002/05/31 10:10:03 itojun Exp $	*/
 
 /*
@@ -73,18 +73,20 @@ int
 sockopen(void)
 {
 	static u_char *rcvcmsgbuf = NULL, *sndcmsgbuf = NULL;
-	int rcvcmsglen, sndcmsglen, on;
+	int rcvcmsgspace, sndcmsgspace, rcvcmsglen, sndcmsglen, on;
 	static u_char answer[1500];
 	struct icmp6_filter filt;
 
 	sndcmsglen = rcvcmsglen = CMSG_SPACE(sizeof(struct in6_pktinfo)) +
+	    CMSG_LEN(sizeof(int));
+	sndcmsgspace = rcvcmsgspace = CMSG_SPACE(sizeof(struct in6_pktinfo)) +
 	    CMSG_SPACE(sizeof(int));
-	if (rcvcmsgbuf == NULL && (rcvcmsgbuf = malloc(rcvcmsglen)) == NULL) {
+	if (rcvcmsgbuf == NULL && (rcvcmsgbuf = malloc(rcvcmsgspace)) == NULL) {
 		warnmsg(LOG_ERR, __func__,
 		    "malloc for receive msghdr failed");
 		return(-1);
 	}
-	if (sndcmsgbuf == NULL && (sndcmsgbuf = malloc(sndcmsglen)) == NULL) {
+	if (sndcmsgbuf == NULL && (sndcmsgbuf = malloc(sndcmsgspace)) == NULL) {
 		warnmsg(LOG_ERR, __func__,
 		    "malloc for send msghdr failed");
 		return(-1);