Charles-François Natali <neolo...@free.fr> added the comment:

I checked in glibc, FreeBSD and OpenBSD source codes, and they all define 
socklen_t as an unsigned integer.
I think the confusion arises from this:
"""
       The  third argument of accept() was originally declared as an int * (and 
is that under libc4 and libc5 and on many other systems like 4.x BSD, SunOS 4, 
SGI); a POSIX.1g
       draft standard wanted to change it into a size_t *, and that is what it 
is for SunOS 5.  Later POSIX drafts have socklen_t *, and so do the  Single  
Unix  Specification
       and glibc2.
"""

But this only implies that sizeof(socklen_t) == sizeof(int).

> since it's set by the kernel.

The only place where we compute it is in sock_sendmsg, but it would be catched 
by overflow checks:
        if (controllen > SOCKLEN_T_LIMIT || controllen < controllen_last) {
            PyErr_SetString(socket_error, "too much ancillary data");
            goto finally;
        }

And we use it as malloc() and memset() argument before it's checked by 
cmsg_min_space...

----------

_______________________________________
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue12837>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

Reply via email to