comparison src/core/ngx_inet.c @ 7120:874171c3c71a

Fixed handling of non-null-terminated unix sockets. At least FreeBSD, macOS, NetBSD, and OpenBSD can return unix sockets with non-null-terminated sun_path. Additionally, the address may become non-null-terminated if it does not fit into the buffer provided and was truncated (may happen on macOS, NetBSD, and Solaris, which allow unix socket addresess larger than struct sockaddr_un). As such, ngx_sock_ntop() might overread the sockaddr provided, as it used "%s" format and thus assumed null-terminated string. To fix this, the ngx_strnlen() function was introduced, and it is now used to calculate correct length of sun_path.
author Maxim Dounin <mdounin@mdounin.ru>
date Wed, 04 Oct 2017 21:19:38 +0300
parents 3f94a0fc05cf
children 935b1902a7dd
comparison
equal deleted inserted replaced
7119:fef61d26da39 7120:874171c3c71a
239 239
240 if (socklen <= (socklen_t) offsetof(struct sockaddr_un, sun_path)) { 240 if (socklen <= (socklen_t) offsetof(struct sockaddr_un, sun_path)) {
241 p = ngx_snprintf(text, len, "unix:%Z"); 241 p = ngx_snprintf(text, len, "unix:%Z");
242 242
243 } else { 243 } else {
244 p = ngx_snprintf(text, len, "unix:%s%Z", saun->sun_path); 244 n = ngx_strnlen((u_char *) saun->sun_path,
245 socklen - offsetof(struct sockaddr_un, sun_path));
246 p = ngx_snprintf(text, len, "unix:%*s%Z", n, saun->sun_path);
245 } 247 }
246 248
247 /* we do not include trailing zero in address length */ 249 /* we do not include trailing zero in address length */
248 250
249 return (p - text - 1); 251 return (p - text - 1);