| CC: | p5p [...] perl.org |
| Subject: | Socket inet_ntop overflow |
The blead version of Socket has a similar overflow problem as RT #111594
But this time detected on darwin, not only on linux.
2.007 does not seem to have it fixed.
See attached patch, detected with asan.
$ valgrind perl -Mblib t/sockaddr.t
==52123== Invalid read of size 8
==52123== at 0x8B4A2C: XS_Socket_inet_ntop (in /Users/rurban/.cpan/build/Socket-2.007-
WAywC4/blib/arch/auto/Socket/Socket.bundle)
--
Reini Urban
| Subject: | Socket-inet_ntop-overflow.patch |
diff --git a/cpan/Socket/Socket.xs b/cpan/Socket/Socket.xs
index 4bfaada..58837aa 100644
--- a/cpan/Socket/Socket.xs
+++ b/cpan/Socket/Socket.xs
@@ -934,8 +934,13 @@ inet_ntop(af, ip_address_sv)
#endif
"Socket::inet_ntop", af);
}
-
- Copy(ip_address, &addr, sizeof addr, char);
+ if (addrlen < sizeof(addr)) {
+ Copy(ip_address, &addr, addrlen, char);
+ Zero(&addr+addrlen, sizeof(addr)-addrlen, char);
+ }
+ else {
+ Copy(ip_address, &addr, sizeof addr, char);
+ }
inet_ntop(af, &addr, str, sizeof str);
ST(0) = sv_2mortal(newSVpvn(str, strlen(str)));