mirror of
https://github.com/RGBCube/serenity
synced 2025-05-28 19:15:09 +00:00
LibCore: Prefer strlcpy over strncpy, fix overflow
A malicious caller can create a SocketAddress for a local unix socket with an over-long name that does not fit into struct sock_addr_un. - Socket::connet: This caused the 'sun_path' field to overflow, probably overwriting the return pointer of the call frame, and thus crashing the process (in the best case). - SocketAddress::to_sockaddr_un: This triggered a RELEASE_ASSERT, and thus crashing the process. Both have been fixed to return a nice error code instead of crashing.
This commit is contained in:
parent
d419a780ae
commit
e682967d7e
4 changed files with 25 additions and 5 deletions
|
@ -43,7 +43,7 @@ public:
|
|||
Local
|
||||
};
|
||||
|
||||
SocketAddress() {}
|
||||
SocketAddress() { }
|
||||
SocketAddress(const IPv4Address& address)
|
||||
: m_type(Type::IPv4)
|
||||
, m_ipv4_address(address)
|
||||
|
@ -82,12 +82,14 @@ public:
|
|||
}
|
||||
}
|
||||
|
||||
sockaddr_un to_sockaddr_un() const
|
||||
Optional<sockaddr_un> to_sockaddr_un() const
|
||||
{
|
||||
ASSERT(type() == Type::Local);
|
||||
sockaddr_un address;
|
||||
address.sun_family = AF_LOCAL;
|
||||
RELEASE_ASSERT(m_local_address.length() < (int)sizeof(address.sun_path));
|
||||
if (m_local_address.length() >= sizeof(address.sun_path)) {
|
||||
return {};
|
||||
}
|
||||
strcpy(address.sun_path, m_local_address.characters());
|
||||
return address;
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue