瀏覽代碼

[Fix] Fix copying of sockaddr_un addresses

They can be very tiny (hence the adjustment of the size assert)
and the path can contain intermittent null bytes, so the only choice
is to trust the input slen and copy the whole struct.

An autobound unix socket uses an abstract address, which starts with a
null byte, hence this change is neccesary for such an address getting
copied properly.
tags/3.3
Timo Rothenpieler 1 年之前
父節點
當前提交
e648f720d3
共有 1 個檔案被更改,包括 8 行新增6 行删除
  1. 8
    6
      src/libutil/addr.c

+ 8
- 6
src/libutil/addr.c 查看文件

@@ -1680,7 +1680,8 @@ rspamd_inet_address_from_sa (const struct sockaddr *sa, socklen_t slen)
rspamd_inet_addr_t *addr;

g_assert (sa != NULL);
g_assert (slen >= sizeof (struct sockaddr));
/* Address of an AF_UNIX socket can be tiny */
g_assert (slen >= sizeof (sa_family_t) + 1);

addr = rspamd_inet_addr_create (sa->sa_family, NULL);

@@ -1689,12 +1690,13 @@ rspamd_inet_address_from_sa (const struct sockaddr *sa, socklen_t slen)
const struct sockaddr_un *un = (const struct sockaddr_un *)sa;

g_assert (slen >= SUN_LEN (un));
g_assert (slen <= sizeof (addr->u.un->addr));

rspamd_strlcpy (addr->u.un->addr.sun_path, un->sun_path,
sizeof (addr->u.un->addr.sun_path));
#if defined(FREEBSD) || defined(__APPLE__)
addr->u.un->addr.sun_len = un->sun_len;
#endif
/* sun_path can legally contain intermittent NULL bytes */
memcpy (&addr->u.un->addr, un, slen);
/* length of AF_UNIX addresses is variable */
addr->slen = slen;
}
else if (sa->sa_family == AF_INET) {
g_assert (slen >= sizeof (struct sockaddr_in));

Loading…
取消
儲存