PATCH 1/3: socket: fix some issues with socket name

Mikael Magnusson <[email protected]>
Newsgroups gmane.comp.shells.zsh.devel
Message-ID <[email protected]>
If the passed name was too long, it was silently truncated. If it was
exactly the max length, the string was not nul terminated.

% zsocket -l aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
==421== Syscall param socketcall.bind(my_addr.sun_path) points to uninitialised byte(s)
==421==    at 0x4DD77D7: bind (in /lib64/libc-2.32.so)
==421==    by 0x61FB31A: bin_zsocket (in /usr/local/lib64/zsh/5.9.0.3-test-mika/zsh/net/socket.so)
==421==    by 0x4217BF: execbuiltin (in /usr/local/bin/zsh)
==421==    by 0x433751: execcmd_exec (in /usr/local/bin/zsh)
==421==    by 0x433D2B: execpline2 (in /usr/local/bin/zsh)
==421==    by 0x434084: execpline (in /usr/local/bin/zsh)
==421==    by 0x4359F8: execlist (in /usr/local/bin/zsh)
==421==    by 0x4362A1: execode (in /usr/local/bin/zsh)
==421==    by 0x44F7A1: loop (in /usr/local/bin/zsh)
==421==    by 0x450AAD: zsh_main (in /usr/local/bin/zsh)
==421==    by 0x4D01E69: (below main) (in /lib64/libc-2.32.so)
==421==  Address 0x1ffeffd7ad is on thread 1's stack
==421==  in frame #1, created by bin_zsocket (???:)
---
 Src/Modules/socket.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/Src/Modules/socket.c b/Src/Modules/socket.c
index c65b7dfce4..4f2a6ecbfa 100644
--- a/Src/Modules/socket.c
+++ b/Src/Modules/socket.c
@@ -58,7 +58,7 @@ bin_zsocket(char *nam, char **args, Options ops, UNUSED(int func))
 {
     int err=1, verbose=0, test=0, targetfd=0;
     ZSOCKLEN_T len;
-    struct sockaddr_un soun;
+    struct sockaddr_un soun = { 0 };
     int sfd;
 
     if (OPT_ISSET(ops,'v'))
@@ -90,6 +90,10 @@ bin_zsocket(char *nam, char **args, Options ops, UNUSED(int func))
 	}
 
 	localfn = args[0];
+	if (strlen(localfn) >= sizeof(soun.sun_path)) {
+	    zwarnnam(nam, "socket path too long: %d > %d", strlen(localfn), sizeof(soun.sun_path) -1 );
+	    return 1;
+	}
 
 	sfd = socket(PF_UNIX, SOCK_STREAM, 0);
 
@@ -232,6 +236,11 @@ bin_zsocket(char *nam, char **args, Options ops, UNUSED(int func))
 	    return 1;
 	}
 
+	if (strlen(args[0]) >= sizeof(soun.sun_path)) {
+	    zwarnnam(nam, "socket path too long: %d > %d", strlen(args[0]), sizeof(soun.sun_path) -1 );
+	    return 1;
+	}
+
 	sfd = socket(PF_UNIX, SOCK_STREAM, 0);
 
 	if (sfd == -1) {
-- 
2.38.1
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.