syscall: ParseUnixCredentials is unsafe

[iangudger]

syscall.ParseUnixCredentials does not sufficiently validate its inputs to avoid crashes or returning uninitialized memory to the caller (via unsafe use of unsafe).

Current code:

// ParseUnixCredentials decodes a socket control message that contains
// credentials in a Ucred structure. To receive such a message, the
// SO_PASSCRED option must be enabled on the socket.
func ParseUnixCredentials(m *SocketControlMessage) (*Ucred, error) {
    if m.Header.Level != SOL_SOCKET {
        return nil, EINVAL
    }
    if m.Header.Type != SCM_CREDENTIALS {
        return nil, EINVAL
    }
    ucred := *(*Ucred)(unsafe.Pointer(&m.Data[0]))
    return &ucred, nil
}

The Data field is blindly cast to a Ucred type without checking the length.

Correct code might look something like:

// ParseUnixCredentials decodes a socket control message that contains
// credentials in a Ucred structure. To receive such a message, the
// SO_PASSCRED option must be enabled on the socket.
func ParseUnixCredentials(m *SocketControlMessage) (*Ucred, error) {
    if m.Header.Level != SOL_SOCKET {
        return nil, EINVAL
    }
    if m.Header.Type != SCM_CREDENTIALS {
        return nil, EINVAL
    }
    if len(m.Data) < SizeofUcred {
        return nil, EINVAL
    }
    ucred := *(*Ucred)(unsafe.Pointer(&m.Data[0]))
    return &ucred, nil
}

[bradfitz]

People who like this bug also like #15653

[gopherbot]

CL https://golang.org/cl/25154 mentions this issue.