|
 |
1d4d17 |
From e0baf20067a75f093d690bd51a6db3f5afabca77 Mon Sep 17 00:00:00 2001
|
|
|
1d4d17 |
From: Petr Vorel <pvorel@suse.cz>
|
|
|
1d4d17 |
Date: Tue, 17 Jul 2018 17:56:10 +0200
|
|
|
1d4d17 |
Subject: [PATCH] tracepath: Fix copying input IPv6 address
|
|
|
1d4d17 |
|
|
|
1d4d17 |
Commit e669c86 broke copying input IPv6 address.
|
|
|
1d4d17 |
tracepath recover from it, but it's slower.
|
|
|
1d4d17 |
|
|
|
1d4d17 |
Previously was address too short:
|
|
|
1d4d17 |
|
|
|
1d4d17 |
strace ./tracepath -6 fe80::8895:e2af:e96e:fd8f
|
|
|
1d4d17 |
sendto(3, "\1\0\0\0\0\0\0\0\307\36N[\0\0\0\0w_\f\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 127952, 0, {sa_family=AF_INET6, sin6_port=htons(44444), inet_pton(AF_INET6, "fe80::", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, 28) = -1 EMSGSIZE (Message too long)
|
|
|
1d4d17 |
|
|
|
1d4d17 |
After fix is correct:
|
|
|
1d4d17 |
|
|
|
1d4d17 |
sendto(3, "\1\0\0\0\0\0\0\0\300\36N[\0\0\0\0'B\3\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 127952, 0, {sa_family=AF_INET6, sin6_port=htons(44444), inet_pton(AF_INET6, "fe80::8895:e2af:e96e:fd8f", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, 28) = -1 EMSGSIZE (Message too long)
|
|
|
1d4d17 |
|
|
|
1d4d17 |
Bug found by LTP test.
|
|
|
1d4d17 |
|
|
|
1d4d17 |
Fixes: e669c86 tracepath: fix heap-buffer-overflow [asan]
|
|
|
1d4d17 |
Fixes: #137
|
|
|
1d4d17 |
---
|
|
|
1d4d17 |
tracepath.c | 2 +-
|
|
|
1d4d17 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
1d4d17 |
|
|
|
1d4d17 |
diff --git a/tracepath.c b/tracepath.c
|
|
|
1d4d17 |
index 53bda16f..539a7a11 100644
|
|
|
1d4d17 |
--- a/tracepath.c
|
|
|
1d4d17 |
+++ b/tracepath.c
|
|
|
1d4d17 |
@@ -475,7 +475,7 @@ int main(int argc, char **argv)
|
|
|
1d4d17 |
fd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
|
|
|
1d4d17 |
if (fd < 0)
|
|
|
1d4d17 |
continue;
|
|
|
1d4d17 |
- memcpy(&target, ai->ai_addr, sizeof(*ai->ai_addr));
|
|
|
1d4d17 |
+ memcpy(&target, ai->ai_addr, ai->ai_addrlen);
|
|
|
1d4d17 |
targetlen = ai->ai_addrlen;
|
|
|
1d4d17 |
break;
|
|
|
1d4d17 |
}
|