* af_unix unix_getname: return size for unnamed sockets too small?
@ 2011-02-02 17:40 Marcus Meissner
2011-02-02 18:59 ` Eric W. Biederman
0 siblings, 1 reply; 2+ messages in thread
From: Marcus Meissner @ 2011-02-02 17:40 UTC (permalink / raw)
To: davem, eric.dumazet, ebiederm, netdev, linux-kernel, gorcunov
Hi,
In net/unix/af_unix.c::unix_getname() there is a small problem:
if (!u->addr) {
sunaddr->sun_family = AF_UNIX;
sunaddr->sun_path[0] = 0; // not copied out
*uaddr_len = sizeof(short);
} else {
struct unix_address *addr = u->addr;
*uaddr_len = addr->len;
memcpy(sunaddr, addr->name, *uaddr_len);
}
The if (!u->addr) case will not copy out the \0 in the sun_path, as
uaddr_len is just the size of sun_family.
(Shown by socat crashing after decoding gethostname return and expected
sun_path to be a valid string (and not seeing the \0)).
Should it perhaps be *uaddr_len = sizeof(short)+sizeof(char)?
Ciao, Marcus
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: af_unix unix_getname: return size for unnamed sockets too small?
2011-02-02 17:40 af_unix unix_getname: return size for unnamed sockets too small? Marcus Meissner
@ 2011-02-02 18:59 ` Eric W. Biederman
0 siblings, 0 replies; 2+ messages in thread
From: Eric W. Biederman @ 2011-02-02 18:59 UTC (permalink / raw)
To: Marcus Meissner; +Cc: davem, eric.dumazet, netdev, linux-kernel, gorcunov
Marcus Meissner <meissner@suse.de> writes:
> Hi,
>
> In net/unix/af_unix.c::unix_getname() there is a small problem:
>
> if (!u->addr) {
> sunaddr->sun_family = AF_UNIX;
> sunaddr->sun_path[0] = 0; // not copied out
> *uaddr_len = sizeof(short);
> } else {
> struct unix_address *addr = u->addr;
>
> *uaddr_len = addr->len;
> memcpy(sunaddr, addr->name, *uaddr_len);
> }
>
> The if (!u->addr) case will not copy out the \0 in the sun_path, as
> uaddr_len is just the size of sun_family.
>
> (Shown by socat crashing after decoding gethostname return and expected
> sun_path to be a valid string (and not seeing the \0)).
Perhaps my memory is scrambled but the sun_path has embedded '\0's so I
don't see how a correct application can expect the path to be '\0'
terminated. An application should be looking at the length we give it.
> Should it perhaps be *uaddr_len = sizeof(short)+sizeof(char)?
I don't think so.
Eric
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-02-02 18:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-02-02 17:40 af_unix unix_getname: return size for unnamed sockets too small? Marcus Meissner
2011-02-02 18:59 ` Eric W. Biederman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.