Fix CMSG_NXTHDR soundness and boundary checks

libc-test/tests/cmsg.rs

@@ -17,8 +17,6 @@ mod t {
 
     extern "C" {
         pub fn cmsg_firsthdr(msgh: *const msghdr) -> *mut cmsghdr;
-        // see below
-        #[cfg(not(target_arch = "sparc64"))]
         pub fn cmsg_nxthdr(mhdr: *const msghdr, cmsg: *const cmsghdr) -> *mut cmsghdr;
         pub fn cmsg_space(length: c_uint) -> usize;
         pub fn cmsg_len(length: c_uint) -> usize;
@@ -58,9 +56,6 @@ mod t {
         }
     }
 
-    // Skip on sparc64
-    // https://github.com/rust-lang/libc/issues/1239
-    #[cfg(not(target_arch = "sparc64"))]
     #[test]
     fn test_cmsg_nxthdr() {
         // Helps to align the buffer on the stack.
@@ -69,32 +64,44 @@ mod t {
 
         const CAPACITY: usize = 512;
         let mut buffer = Align8([0_u8; CAPACITY]);
+        let pcmsghdr = buffer.0.as_mut_ptr().cast::<cmsghdr>();
+
         let mut mhdr: msghdr = unsafe { mem::zeroed() };
-        for start_ofs in 0..64 {
-            let pcmsghdr = buffer.0.as_mut_ptr().cast::<cmsghdr>();
-            mhdr.msg_control = pcmsghdr.cast::<c_void>();
-            mhdr.msg_controllen = (160 - start_ofs) as _;
-            for cmsg_len in 0..64 {
-                // Address must be a multiple of 0x4 for testing on AIX.
-                if cfg!(target_os = "aix") && cmsg_len % std::mem::size_of::<cmsghdr>() != 0 {
-                    continue;
-                }
-                for next_cmsg_len in 0..32 {
+        mhdr.msg_control = pcmsghdr.cast::<c_void>();
+
+        for trunc in 0..64 {
+            mhdr.msg_controllen = (160 - trunc) as _;
+
+            for cmsg_payload_len in 0..64 {
+                let mut current_cmsghdr_ptr = pcmsghdr;
+                assert!(!current_cmsghdr_ptr.is_null());
+                let mut count = 0;
+
+                // Go from first cmsghdr to the last (until null) using various
+                // cmsg_len increments. `cmsg_len` is set by us to check that
+                // the jump to the next cmsghdr is correct with respect to
+                // alignment and payload padding.
+                while !current_cmsghdr_ptr.is_null() {
                     unsafe {
-                        pcmsghdr.cast::<u8>().write_bytes(0, CAPACITY);
-                        (*pcmsghdr).cmsg_len = cmsg_len as _;
-                        let libc_next = libc::CMSG_NXTHDR(&mhdr, pcmsghdr);
-                        let next = cmsg_nxthdr(&mhdr, pcmsghdr);
-                        assert_eq!(libc_next, next);
-
-                        if !libc_next.is_null() {
-                            (*libc_next).cmsg_len = next_cmsg_len;
-                            let libc_next = libc::CMSG_NXTHDR(&mhdr, pcmsghdr);
-                            let next = cmsg_nxthdr(&mhdr, pcmsghdr);
-                            assert_eq!(libc_next, next);
-                        }
+                        (*current_cmsghdr_ptr).cmsg_len =
+                            libc::CMSG_LEN(cmsg_payload_len as _) as _;
+
+                        let libc_next = libc::CMSG_NXTHDR(&mhdr, current_cmsghdr_ptr);
+                        let system_next = cmsg_nxthdr(&mhdr, current_cmsghdr_ptr);
+                        assert_eq!(
+                            system_next, libc_next,
+                            "msg_crontrollen: {}, payload_len: {}, count: {}",
+                            mhdr.msg_controllen, cmsg_payload_len, count
+                        );
+
+                        current_cmsghdr_ptr = libc_next;
+                        count += 1;
                     }
                 }
+
+                unsafe {
+                    pcmsghdr.cast::<u8>().write_bytes(0, CAPACITY);
+                }
             }
         }
     }

src/unix/linux_like/emscripten/mod.rs

@@ -1257,7 +1257,7 @@ f! {
         }
         let next = (cmsg as usize + super::CMSG_ALIGN((*cmsg).cmsg_len as usize)) as *mut cmsghdr;
         let max = (*mhdr).msg_control as usize + (*mhdr).msg_controllen as usize;
-        if (next.offset(1)) as usize > max {
+        if (next.offset(1)) as usize >= max {
             core::ptr::null_mut::<cmsghdr>()
         } else {
             next as *mut cmsghdr

src/unix/linux_like/linux_l4re_shared.rs

@@ -1493,15 +1493,32 @@ f! {
         if ((*cmsg).cmsg_len as usize) < size_of::<crate::cmsghdr>() {
             return core::ptr::null_mut::<crate::cmsghdr>();
         }
-        let next =
-            (cmsg as usize + super::CMSG_ALIGN((*cmsg).cmsg_len as usize)) as *mut crate::cmsghdr;
-        let max = (*mhdr).msg_control as usize + (*mhdr).msg_controllen as usize;
-        if (next.wrapping_offset(1)) as usize > max
-            || next as usize + super::CMSG_ALIGN((*next).cmsg_len as usize) > max
-        {
+
+        // FIXME(msrv): `.wrapping_byte_add()` stabilized in 1.75
+        let next_cmsg = cmsg
+            .cast::<u8>()
+            .wrapping_add(super::CMSG_ALIGN((*cmsg).cmsg_len as usize))
+            .cast::<crate::cmsghdr>();
+
+        // In case the addition wrapped. `next_addr > max_addr`
+        // would otherwise not work as intended.
+        if (next_cmsg as usize) < (cmsg as usize) {
+            return core::ptr::null_mut();
+        }
+
+        let mut max_addr = (*mhdr).msg_control as usize + (*mhdr).msg_controllen as usize;
+
+        if cfg!(any(target_env = "musl", target_env = "ohos")) {
+            // musl and some of its descendants do `>= max_addr`
+            // comparisons in the if statement below.
+            // https://www.openwall.com/lists/musl/2025/12/27/1
+            max_addr -= 1;
+        }
+
+        if next_cmsg as usize + size_of::<crate::cmsghdr>() > max_addr {
             core::ptr::null_mut::<crate::cmsghdr>()
         } else {
-            next
+            next_cmsg as *mut crate::cmsghdr
         }
     }