Code

resolver: set the correct address size for local/abstract sockets
authorMax Kellermann <max.kellermann@gmail.com>
Thu, 21 Sep 2017 08:26:28 +0000 (10:26 +0200)
committerMax Kellermann <max.kellermann@gmail.com>
Thu, 21 Sep 2017 08:26:28 +0000 (10:26 +0200)
Limit the socklen_t to the real path length, and omit the trailing
null terminator in abstract sockets.

src/net/resolver.c

index 952c2c930005ced9e169fa926feea3533c71cd93..2df1b5ad99714dcefe2d017237364c18c7f9d41e 100644 (file)
@@ -29,6 +29,7 @@
 #include "resolver.h"
 #include "config.h"
 
+#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -78,14 +79,17 @@ resolver_new(const char *host, unsigned port)
 
        if (host[0] == '/' || host[0] == '@') {
 #ifndef WIN32
-               size_t path_length = strlen(host);
-               if (path_length >= sizeof(resolver->saun.sun_path)) {
+               const bool is_abstract = *host == '@';
+               /* sun_path must be null-terminated unless it's an abstract
+                  socket */
+               const size_t path_length = strlen(host) + !is_abstract;
+               if (path_length > sizeof(resolver->saun.sun_path)) {
                        free(resolver);
                        return NULL;
                }
 
                resolver->saun.sun_family = AF_UNIX;
-               memcpy(resolver->saun.sun_path, host, path_length + 1);
+               memcpy(resolver->saun.sun_path, host, path_length);
 
                if (host[0] == '@')
                        /* abstract socket */
@@ -93,7 +97,8 @@ resolver_new(const char *host, unsigned port)
 
                resolver->current.family = PF_UNIX;
                resolver->current.protocol = 0;
-               resolver->current.addrlen = sizeof(resolver->saun);
+               resolver->current.addrlen = sizeof(resolver->saun)
+                       - sizeof(resolver->saun.sun_path) + path_length;
                resolver->current.addr = (const struct sockaddr *)&resolver->saun;
                resolver->type = TYPE_ONE;
 #else /* WIN32 */