Zsh Mailing List Archive
Messages sorted by: Reverse Date, Date, Thread, Author

PATCH 1/3: socket: fix some issues with socket name



If the passed name was too long, it was silently truncated. If it was
exactly the max length, the string was not nul terminated.

% zsocket -l aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
==421== Syscall param socketcall.bind(my_addr.sun_path) points to uninitialised byte(s)
==421==    at 0x4DD77D7: bind (in /lib64/libc-2.32.so)
==421==    by 0x61FB31A: bin_zsocket (in /usr/local/lib64/zsh/5.9.0.3-test-mika/zsh/net/socket.so)
==421==    by 0x4217BF: execbuiltin (in /usr/local/bin/zsh)
==421==    by 0x433751: execcmd_exec (in /usr/local/bin/zsh)
==421==    by 0x433D2B: execpline2 (in /usr/local/bin/zsh)
==421==    by 0x434084: execpline (in /usr/local/bin/zsh)
==421==    by 0x4359F8: execlist (in /usr/local/bin/zsh)
==421==    by 0x4362A1: execode (in /usr/local/bin/zsh)
==421==    by 0x44F7A1: loop (in /usr/local/bin/zsh)
==421==    by 0x450AAD: zsh_main (in /usr/local/bin/zsh)
==421==    by 0x4D01E69: (below main) (in /lib64/libc-2.32.so)
==421==  Address 0x1ffeffd7ad is on thread 1's stack
==421==  in frame #1, created by bin_zsocket (???:)
---
 Src/Modules/socket.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/Src/Modules/socket.c b/Src/Modules/socket.c
index c65b7dfce4..4f2a6ecbfa 100644
--- a/Src/Modules/socket.c
+++ b/Src/Modules/socket.c
@@ -58,7 +58,7 @@ bin_zsocket(char *nam, char **args, Options ops, UNUSED(int func))
 {
     int err=1, verbose=0, test=0, targetfd=0;
     ZSOCKLEN_T len;
-    struct sockaddr_un soun;
+    struct sockaddr_un soun = { 0 };
     int sfd;
 
     if (OPT_ISSET(ops,'v'))
@@ -90,6 +90,10 @@ bin_zsocket(char *nam, char **args, Options ops, UNUSED(int func))
 	}
 
 	localfn = args[0];
+	if (strlen(localfn) >= sizeof(soun.sun_path)) {
+	    zwarnnam(nam, "socket path too long: %d > %d", strlen(localfn), sizeof(soun.sun_path) -1 );
+	    return 1;
+	}
 
 	sfd = socket(PF_UNIX, SOCK_STREAM, 0);
 
@@ -232,6 +236,11 @@ bin_zsocket(char *nam, char **args, Options ops, UNUSED(int func))
 	    return 1;
 	}
 
+	if (strlen(args[0]) >= sizeof(soun.sun_path)) {
+	    zwarnnam(nam, "socket path too long: %d > %d", strlen(args[0]), sizeof(soun.sun_path) -1 );
+	    return 1;
+	}
+
 	sfd = socket(PF_UNIX, SOCK_STREAM, 0);
 
 	if (sfd == -1) {
-- 
2.38.1





Messages sorted by: Reverse Date, Date, Thread, Author