SOCK5 crash+fix
Gisle Vanem <[email protected]>
| Newsgroups | gmane.comp.web.lynx.devel |
|---|---|
| Message-ID | <[email protected]> |
While trying Lynx with Tor's SOCK5 proxy:
lynx -dump -socks5_proxy=localhost:9050
https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6aucdccrad.onion/
(the BBC Homepage), I got a strange crash for this code:
socks5_protocol = HTSprintf0(NULL,
gettext("(for %s at %s) SOCKS5"),
protocol, socks5_host);
A NULL-ptr read which I fail to understand.
But simply replacing with:
char socks5_buf [1000];
...
snprintf(socks5_buf, sizeof(socks5_buf),
gettext("(for %s at %s) SOCKS5"), protocol, socks5_host);
protocol = socks5_buf;
plus some other patches to HTTCP.c (attached), Lynx+Tor
works on Windows-10. The diff is against the 2.9.0dev.10
version. Latest I believe (?)
--
--gv
HTTCP.c.diff
(text/plain, 2.6 KB)
--- orig/WWW/Library/Implementation/HTTCP.c 2021-06-09 01:44:43
+++ WWW/Library/Implementation/HTTCP.c 2022-03-10 14:11:59
@@ -1828,9 +1828,9 @@
char *socks5_host = NULL;
unsigned socks5_host_len = 0;
int socks5_port;
+ char socks5_buf [1000];
const char *socks5_orig_url;
char *socks5_new_url = NULL;
- char *socks5_protocol = NULL;
int status = HT_OK;
char *line = NULL;
char *p1 = NULL;
@@ -1888,10 +1888,9 @@
HTSACat(&socks5_new_url, socks5_proxy);
url = socks5_new_url;
- socks5_protocol = HTSprintf0(NULL,
- gettext("(for %s at %s) SOCKS5"),
- protocol, socks5_host);
- protocol = socks5_protocol;
+ snprintf(socks5_buf, sizeof(socks5_buf),
+ gettext("(for %s at %s) SOCKS5"), protocol, socks5_host);
+ protocol = socks5_buf;
}
#ifndef INET6
/*
@@ -2032,8 +2031,10 @@
* write service procedure. This will be
* the normal case.
*/
+ CTRACE((tfp, "connect(): status: %d, SOCK_ERRNO: %d\n", status, SOCKET_ERRNO));
+
if ((status < 0) &&
- (SOCKET_ERRNO == EINPROGRESS
+ (SOCKET_ERRNO == EINPROGRESS || SOCKET_ERRNO == 112
#ifdef EAGAIN
|| SOCKET_ERRNO == EAGAIN
#endif
@@ -2091,7 +2092,7 @@
* If we suspend, then it is possible that select will be
* interrupted. Allow for this possibility. - JED
*/
- if ((ret == -1) && (errno == EINTR))
+ if ((ret == -1) && (SOCKET_ERRNO == EINTR))
continue;
#ifdef SOCKET_DEBUG_TRACE
@@ -2273,7 +2281,7 @@
pbuf[0] = 0x05; /* VER: protocol version: X'05' */
pbuf[1] = 0x01; /* NMETHODS: 1 */
pbuf[2] = 0x00; /* METHOD: X'00' NO AUTHENTICATION REQUIRED */
- if (write(*s, pbuf, 3) != 3) {
+ if (NETWRITE(*s, pbuf, 3) != 3) {
goto report_system_err;
} else if (HTDoRead(*s, pbuf, 2) != 2) {
goto report_system_err;
@@ -2298,7 +2306,7 @@
memcpy(&pbuf[i], (unsigned char *) &x, sizeof x);
i += (unsigned) sizeof(x);
}
- if ((size_t) write(*s, pbuf, i) != i) {
+ if ((size_t) NETWRITE(*s, pbuf, i) != i) {
goto report_system_err;
} else if ((unsigned) HTDoRead(*s, pbuf, 4) != 4) {
goto report_system_err;
@@ -2396,7 +2404,6 @@
cleanup:
if (socks5_proxy != NULL) {
FREE(socks5_new_url);
- FREE(socks5_protocol);
FREE(socks5_host);
}
FREE(host);
@@ -2534,7 +2541,7 @@
break;
}
#else /* UNIX */
- result = SOCKET_READ(fildes, buf, nbyte);
+ result = NETREAD(fildes, buf, nbyte);
#endif /* !UNIX */
#endif /* UCX && VAXC */
}