As RFC 2292 points out, some platforms (e.g. Darwin 9.8.0) provide
CMSG_FIRSTHDR(msg) which just returns msg.msg_control without first
checking if msg.msg_controllen is non-zero. We need a workaround for
such platforms not to let _xcb_in_read() segfault.
https://bugs.freedesktop.org/show_bug.cgi?id=72253
Signed-off-by: Julien Cristau <jcristau@debian.org>
#if HAVE_SENDMSG
struct cmsghdr *hdr;
#if HAVE_SENDMSG
struct cmsghdr *hdr;
- for (hdr = CMSG_FIRSTHDR(&msg); hdr; hdr = CMSG_NXTHDR(&msg, hdr)) {
- if (hdr->cmsg_level == SOL_SOCKET && hdr->cmsg_type == SCM_RIGHTS) {
- int nfd = (hdr->cmsg_len - CMSG_LEN(0)) / sizeof (int);
- memcpy(&c->in.in_fd.fd[c->in.in_fd.nfd], CMSG_DATA(hdr), nfd * sizeof (int));
- c->in.in_fd.nfd += nfd;
+ if (msg.msg_controllen >= sizeof (struct cmsghdr)) {
+ for (hdr = CMSG_FIRSTHDR(&msg); hdr; hdr = CMSG_NXTHDR(&msg, hdr)) {
+ if (hdr->cmsg_level == SOL_SOCKET && hdr->cmsg_type == SCM_RIGHTS) {
+ int nfd = (hdr->cmsg_len - CMSG_LEN(0)) / sizeof (int);
+ memcpy(&c->in.in_fd.fd[c->in.in_fd.nfd], CMSG_DATA(hdr), nfd * sizeof (int));
+ c->in.in_fd.nfd += nfd;
+ }