mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-31 16:57:10 +00:00
Code Issues Releases Activity

Use bcopy instead of strlcpy in uipc_bind and unp_connect, since

Browse Source 
soun->sun_path isn't a null-terminated string.  As UNIX(4) states, "the
terminating NUL is not part of the address."  Since strlcpy has to return
"the total length of the string [it] tried to create," it walks off the end
of soun->sun_path looking for a \0.

This reverts r105332.

Reported by:    Ryan Stone
This commit is contained in:
Ed Maste 2008-07-03 23:26:10 +00:00
parent 8bb8d6397d
commit 7928893d83
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=180238
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/kern/uipc_usrreq.c
View File

@ -416,7 +416,8 @@ uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
UNP_PCB_UNLOCK(unp);
buf = malloc(namelen + 1, M_TEMP, M_WAITOK);
strlcpy(buf, soun->sun_path, namelen + 1);
bcopy(soun->sun_path, buf, namelen);
buf[namelen] = 0;
restart:
vfslocked = 0;
@ -1129,7 +1130,8 @@ unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
if (len <= 0)
return (EINVAL);
strlcpy(buf, soun->sun_path, len + 1);
bcopy(soun->sun_path, buf, len);
buf[len] = 0;
UNP_PCB_LOCK(unp);
if (unp->unp_flags & UNP_CONNECTING) {