|
 |
e2ec8a |
From a652268ae11633cf64c87586bed1fd3c7141707a Mon Sep 17 00:00:00 2001
|
|
|
e2ec8a |
From: Yu Watanabe <watanabe.yu+github@gmail.com>
|
|
|
e2ec8a |
Date: Wed, 22 Aug 2018 12:33:27 +0900
|
|
|
e2ec8a |
Subject: [PATCH] util: do not use stack frame for parsing arbitrary inputs
|
|
|
e2ec8a |
|
|
|
e2ec8a |
This replaces strndupa() by strndup() in socket_address_parse(),
|
|
|
e2ec8a |
as input string may be too long.
|
|
|
e2ec8a |
|
|
|
e2ec8a |
Fixes issue 10007 by ClusterFuzz-External:
|
|
|
e2ec8a |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10007
|
|
|
e2ec8a |
|
|
|
e2ec8a |
(cherry picked from commit 8d30fcb9b51b1d102a589171b6e28f5f370236f6)
|
|
|
e2ec8a |
|
|
|
e2ec8a |
Resolves: #1696224
|
|
|
e2ec8a |
---
|
|
|
e2ec8a |
src/basic/socket-util.c | 16 ++++++++++++----
|
|
|
e2ec8a |
1 file changed, 12 insertions(+), 4 deletions(-)
|
|
|
e2ec8a |
|
|
|
e2ec8a |
diff --git a/src/basic/socket-util.c b/src/basic/socket-util.c
|
|
|
e2ec8a |
index a913102e13..3f90a81d35 100644
|
|
|
e2ec8a |
--- a/src/basic/socket-util.c
|
|
|
e2ec8a |
+++ b/src/basic/socket-util.c
|
|
|
e2ec8a |
@@ -50,7 +50,8 @@ static const char* const socket_address_type_table[] = {
|
|
|
e2ec8a |
DEFINE_STRING_TABLE_LOOKUP(socket_address_type, int);
|
|
|
e2ec8a |
|
|
|
e2ec8a |
int socket_address_parse(SocketAddress *a, const char *s) {
|
|
|
e2ec8a |
- char *e, *n;
|
|
|
e2ec8a |
+ _cleanup_free_ char *n = NULL;
|
|
|
e2ec8a |
+ char *e;
|
|
|
e2ec8a |
int r;
|
|
|
e2ec8a |
|
|
|
e2ec8a |
assert(a);
|
|
|
e2ec8a |
@@ -68,7 +69,9 @@ int socket_address_parse(SocketAddress *a, const char *s) {
|
|
|
e2ec8a |
if (!e)
|
|
|
e2ec8a |
return -EINVAL;
|
|
|
e2ec8a |
|
|
|
e2ec8a |
- n = strndupa(s+1, e-s-1);
|
|
|
e2ec8a |
+ n = strndup(s+1, e-s-1);
|
|
|
e2ec8a |
+ if (!n)
|
|
|
e2ec8a |
+ return -ENOMEM;
|
|
|
e2ec8a |
|
|
|
e2ec8a |
errno = 0;
|
|
|
e2ec8a |
if (inet_pton(AF_INET6, n, &a->sockaddr.in6.sin6_addr) <= 0)
|
|
|
e2ec8a |
@@ -125,7 +128,10 @@ int socket_address_parse(SocketAddress *a, const char *s) {
|
|
|
e2ec8a |
if (r < 0)
|
|
|
e2ec8a |
return r;
|
|
|
e2ec8a |
|
|
|
e2ec8a |
- n = strndupa(cid_start, e - cid_start);
|
|
|
e2ec8a |
+ n = strndup(cid_start, e - cid_start);
|
|
|
e2ec8a |
+ if (!n)
|
|
|
e2ec8a |
+ return -ENOMEM;
|
|
|
e2ec8a |
+
|
|
|
e2ec8a |
if (!isempty(n)) {
|
|
|
e2ec8a |
r = safe_atou(n, &a->sockaddr.vm.svm_cid);
|
|
|
e2ec8a |
if (r < 0)
|
|
|
e2ec8a |
@@ -146,7 +152,9 @@ int socket_address_parse(SocketAddress *a, const char *s) {
|
|
|
e2ec8a |
if (r < 0)
|
|
|
e2ec8a |
return r;
|
|
|
e2ec8a |
|
|
|
e2ec8a |
- n = strndupa(s, e-s);
|
|
|
e2ec8a |
+ n = strndup(s, e-s);
|
|
|
e2ec8a |
+ if (!n)
|
|
|
e2ec8a |
+ return -ENOMEM;
|
|
|
e2ec8a |
|
|
|
e2ec8a |
/* IPv4 in w.x.y.z:p notation? */
|
|
|
e2ec8a |
r = inet_pton(AF_INET, n, &a->sockaddr.in.sin_addr);
|