|
 |
bc6e22 |
From 937ae00b413b46f84aa77b5ca0dae38ed2b3415a Mon Sep 17 00:00:00 2001
|
|
|
bc6e22 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
bc6e22 |
Date: Wed, 31 Aug 2022 13:00:52 +0200
|
|
|
bc6e22 |
Subject: [PATCH] local: Avoid sockaddr_un::sun_path buffer overflow
|
|
|
bc6e22 |
|
|
|
bc6e22 |
The array's size in struct sockaddr_un is only UNIX_PATH_MAX and
|
|
|
bc6e22 |
according to unix(7), it should hold a null-terminated string. So adjust
|
|
|
bc6e22 |
config reader to reject paths of length UNIX_PATH_MAX and above and
|
|
|
bc6e22 |
adjust the internal arrays to aid the compiler.
|
|
|
bc6e22 |
|
|
|
bc6e22 |
Fixes: f196de88cdd97 ("src: fix strncpy -Wstringop-truncation warnings")
|
|
|
bc6e22 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
bc6e22 |
(cherry picked from commit 96980c548d3a1aeb07ab6aaef45389efb058a69a)
|
|
|
bc6e22 |
---
|
|
|
bc6e22 |
include/local.h | 4 ++--
|
|
|
bc6e22 |
src/read_config_yy.y | 6 +++---
|
|
|
bc6e22 |
2 files changed, 5 insertions(+), 5 deletions(-)
|
|
|
bc6e22 |
|
|
|
bc6e22 |
diff --git a/include/local.h b/include/local.h
|
|
|
bc6e22 |
index 9379446732eed..22859d7ab60aa 100644
|
|
|
bc6e22 |
--- a/include/local.h
|
|
|
bc6e22 |
+++ b/include/local.h
|
|
|
bc6e22 |
@@ -7,12 +7,12 @@
|
|
|
bc6e22 |
|
|
|
bc6e22 |
struct local_conf {
|
|
|
bc6e22 |
int reuseaddr;
|
|
|
bc6e22 |
- char path[UNIX_PATH_MAX + 1];
|
|
|
bc6e22 |
+ char path[UNIX_PATH_MAX];
|
|
|
bc6e22 |
};
|
|
|
bc6e22 |
|
|
|
bc6e22 |
struct local_server {
|
|
|
bc6e22 |
int fd;
|
|
|
bc6e22 |
- char path[UNIX_PATH_MAX + 1];
|
|
|
bc6e22 |
+ char path[UNIX_PATH_MAX];
|
|
|
bc6e22 |
};
|
|
|
bc6e22 |
|
|
|
bc6e22 |
/* callback return values */
|
|
|
bc6e22 |
diff --git a/src/read_config_yy.y b/src/read_config_yy.y
|
|
|
bc6e22 |
index 401a1575014d0..d208a6a0617cf 100644
|
|
|
bc6e22 |
--- a/src/read_config_yy.y
|
|
|
bc6e22 |
+++ b/src/read_config_yy.y
|
|
|
bc6e22 |
@@ -699,12 +699,12 @@ unix_options:
|
|
|
bc6e22 |
|
|
|
bc6e22 |
unix_option : T_PATH T_PATH_VAL
|
|
|
bc6e22 |
{
|
|
|
bc6e22 |
- if (strlen($2) > UNIX_PATH_MAX) {
|
|
|
bc6e22 |
+ if (strlen($2) >= UNIX_PATH_MAX) {
|
|
|
bc6e22 |
dlog(LOG_ERR, "Path is longer than %u characters",
|
|
|
bc6e22 |
- UNIX_PATH_MAX);
|
|
|
bc6e22 |
+ UNIX_PATH_MAX - 1);
|
|
|
bc6e22 |
exit(EXIT_FAILURE);
|
|
|
bc6e22 |
}
|
|
|
bc6e22 |
- snprintf(conf.local.path, sizeof(conf.local.path), "%s", $2);
|
|
|
bc6e22 |
+ strcpy(conf.local.path, $2);
|
|
|
bc6e22 |
free($2);
|
|
|
bc6e22 |
};
|
|
|
bc6e22 |
|
|
|
bc6e22 |
--
|
|
|
bc6e22 |
2.34.1
|
|
|
bc6e22 |
|