lib: fix a Null Pointer Dereference bug in sockopt.c

[mugitya03]

Dear Developers,

We found a potential Null Pointer Dereference bug in file lib/sockopt.c. Here are the details:

The function getsockopt_cmsg_data can return a NULL.

static void *getsockopt_cmsg_data(struct msghdr *msgh, int level, int type)
{
	struct cmsghdr *cmsg;

	for (cmsg = CMSG_FIRSTHDR(msgh); cmsg != NULL;
	     cmsg = CMSG_NXTHDR(msgh, cmsg))
		if (cmsg->cmsg_level == level && cmsg->cmsg_type == type)
			return CMSG_DATA(cmsg);

	return NULL;
}

The null value returned by function getsockopt_cmsg_data is dereferenced in function getsockopt_ipv6_ifindex

static int getsockopt_ipv6_ifindex(struct msghdr *msgh)
{
	struct in6_pktinfo *pktinfo;

	pktinfo = getsockopt_cmsg_data(msgh, IPPROTO_IPV6, IPV6_PKTINFO);

	return pktinfo->ipi6_ifindex;
}

Thus, we add a null value check and return 0 if pointer pktinfo is null.

[Jafaral]

@Mergifyio backport dev/10.3 stable/10.2 stable/10.1 stable/10.0

[mergify]

backport dev/10.3 stable/10.2 stable/10.1 stable/10.0

🟠 Waiting for conditions to match

• merged [📌 backport requirement]

[eqvinox]

For this to happen, basically the kernel must be broken such that IPV6_PKTINFO does not work correctly. If the kernel is not working correctly, we can just close up shop and go home. Agreement on the community call is that we should in fact crash if this happens.

If anything, you can replace this with an assert or assertf, but even that is somewhat of a superfluous change.

[eqvinox]

as commented