title: Linux TCP recv() with MSG_TRUNC - writes to buffer?
body: <p>I've just encountered a surprising buffer overflow, while trying to use the flag MSG_TRUNC in recv on a TCP socket.</p>
  
  <p>And it seems to only happen with gcc (not clang) and only when compiling with optimization.</p>
  
  <p>According to this link: <a href="http://man7.org/linux/man-pages/man7/tcp.7.html" rel="nofollow">http://man7.org/linux/man-pages/man7/tcp.7.html</a></p>
  
  <blockquote>
    <p>Since version 2.4, Linux supports the use of MSG_TRUNC in the flags argument of recv(2) (and recvmsg(2)). This flag causes the received bytes of data to be discarded, rather than passed back in a caller-supplied buffer. Since Linux 2.4.4, MSG_PEEK also has this effect when used in conjunction with MSG_OOB to receive out-of-band data.</p>
  </blockquote>
  
  <p>Does this mean that a supplied buffer will not be written to? I expected so, but was surprised.
  If you pass a buffer (non-zero pointer) and size bigger than the buffer size, it results in buffer overflow when client sends something bigger than buffer. It doesn't actually seem to write the message to the buffer if the message is small and fits in the buffer (no overflow).
  Apparently if you pass a null pointer the problem goes away.</p>
  
  <p>Client is a simple netcat sending a message bigger than 4 characters.</p>
  
  <p>Server code is based on:
  <a href="http://www.linuxhowtos.org/data/6/server.c" rel="nofollow">http://www.linuxhowtos.org/data/6/server.c</a></p>
  
  <p>Changed read to recv with MSG_TRUNC, and buffer size to 4 (bzero to 4 as well).</p>
  
  <p>Compiled on Ubuntu 14.04. These compilations work fine (no warnings):</p>
  
  <blockquote>
    <p>gcc -o server.x server.c</p>
    
    <p>clang -o server.x server.c</p>
    
    <p>clang -O2 server.x server.c</p>
  </blockquote>
  
  <p>This is the buggy (?) compilation, it also gives a warning hinting about the problem:</p>
  
  <blockquote>
    <p>gcc -O2 -o server.x server.c</p>
  </blockquote>
  
  <p>Anyway like I mentioned changing the pointer to null fixes the problem, but is this a known issue? Or did I miss something in the man page?</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>The buffer overflow happens also with gcc -O1.
  Here is the compilation warning:</p>
  
  <blockquote>
    <p>In function ‘recv’,
        inlined from ‘main’ at server.c:47:14:
    /usr/include/x86_64-linux-gnu/bits/socket2.h:42:2: warning: call to ‘__recv_chk_warn’ declared with attribute warning: recv called with bigger length than size of destination buffer [enabled by default]
      return __recv_chk_warn (__fd, __buf, __n, __bos0 (__buf), __flags);</p>
  </blockquote>
  
  <p>Here is the buffer overflow:</p>
  
  <blockquote>
    <p>./server.x 10003
    <strong>* buffer overflow detected *</strong>: ./server.x terminated
    ======= Backtrace: =========
    /lib/x86_64-linux-gnu/libc.so.6(+0x7338f)[0x7fcbdc44b38f]
    /lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7fcbdc4e2c9c]
    /lib/x86_64-linux-gnu/libc.so.6(+0x109b60)[0x7fcbdc4e1b60]
    /lib/x86_64-linux-gnu/libc.so.6(+0x10a023)[0x7fcbdc4e2023]
    ./server.x[0x400a6c]
    /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7fcbdc3f9ec5]
    ./server.x[0x400879]
    ======= Memory map: ========
    00400000-00401000 r-xp 00000000 08:01 17732                              > /tmp/server.x
    ... more messages here
    Aborted (core dumped)</p>
  </blockquote>
  
  <p>And gcc version:</p>
  
  <blockquote>
    <p>gcc (Ubuntu 4.8.4-2ubuntu1~14.04.3) 4.8.4</p>
  </blockquote>
  
  <p>The buffer and recv call:</p>
  
  <blockquote>
    <p>char buffer[4];</p>
    
    <p>n = recv(newsockfd,buffer,255,MSG_TRUNC);</p>
  </blockquote>
  
  <p>And this seems to fix it:</p>
  
  <blockquote>
    <p>n = recv(newsockfd,NULL,255,MSG_TRUNC);</p>
  </blockquote>
  
  <p>This will not generate any warnings or errors:</p>
  
  <blockquote>
    <p>gcc -Wall -Wextra -pedantic -o server.x server.c</p>
  </blockquote>
  
  <p>And here is the complete code:</p>
  
  <pre><code>/* A simple server in the internet domain using TCP
     The port number is passed as an argument */
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;string.h&gt;
  #include &lt;unistd.h&gt;
  #include &lt;sys/types.h&gt; 
  #include &lt;sys/socket.h&gt;
  #include &lt;netinet/in.h&gt;
  
  void error(const char *msg)
  {
      perror(msg);
      exit(1);
  }
  
  int main(int argc, char *argv[])
  {
       int sockfd, newsockfd, portno;
       socklen_t clilen;
       char buffer[4];
       struct sockaddr_in serv_addr, cli_addr;
       int n;
       if (argc &lt; 2) {
           fprintf(stderr,"ERROR, no port provided\n");
           exit(1);
       }
       sockfd = socket(AF_INET, SOCK_STREAM, 0);
       if (sockfd &lt; 0) 
          error("ERROR opening socket");
       bzero((char *) &amp;serv_addr, sizeof(serv_addr));
       portno = atoi(argv[1]);
       serv_addr.sin_family = AF_INET;
       serv_addr.sin_addr.s_addr = INADDR_ANY;
       serv_addr.sin_port = htons(portno);
       if (bind(sockfd, (struct sockaddr *) &amp;serv_addr,
                sizeof(serv_addr)) &lt; 0) 
                error("ERROR on binding");
       listen(sockfd,5);
       clilen = sizeof(cli_addr);
       newsockfd = accept(sockfd, 
                   (struct sockaddr *) &amp;cli_addr, 
                   &amp;clilen);
       if (newsockfd &lt; 0) 
            error("ERROR on accept");
       bzero(buffer,4);
       n = recv(newsockfd,buffer,255,MSG_TRUNC);
       if (n &lt; 0) error("ERROR reading from socket");
       printf("Here is the message: %s\n",buffer);
       n = write(newsockfd,"I got your message",18);
       if (n &lt; 0) error("ERROR writing to socket");
       close(newsockfd);
       close(sockfd);
       return 0; 
  }
  </code></pre>
  
  <p>UPDATE:
  Happens also on Ubuntu 16.04, with gcc version:</p>
  
  <blockquote>
    <p>gcc (Ubuntu 5.4.0-6ubuntu1~16.04.2) 5.4.0 20160609</p>
  </blockquote>