Close #13022: _multiprocessing.recvfd() doesn't check that file descriptor was actually received
diff --git a/Modules/_multiprocessing/multiprocessing.c b/Modules/_multiprocessing/multiprocessing.c
index 7582664..31a8da8 100644
--- a/Modules/_multiprocessing/multiprocessing.c
+++ b/Modules/_multiprocessing/multiprocessing.c
@@ -177,6 +177,17 @@
if (res < 0)
return PyErr_SetFromErrno(PyExc_OSError);
+ if (msg.msg_controllen < CMSG_LEN(sizeof(int)) ||
+ (cmsg = CMSG_FIRSTHDR(&msg)) == NULL ||
+ cmsg->cmsg_level != SOL_SOCKET ||
+ cmsg->cmsg_type != SCM_RIGHTS ||
+ cmsg->cmsg_len < CMSG_LEN(sizeof(int))) {
+ /* If at least one control message is present, there should be
+ no room for any further data in the buffer. */
+ PyErr_SetString(PyExc_RuntimeError, "No file descriptor received");
+ return NULL;
+ }
+
fd = * (int *) CMSG_DATA(cmsg);
return Py_BuildValue("i", fd);
}