Mercurial > hg > nginx

changeset 7283:d0b897c0bb5b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Events: fixed handling zero-length client address. On Linux recvmsg() syscall may return a zero-length client address when receiving a datagram from an unbound unix datagram socket. It is usually assumed that socket address has at least the sa_family member. Zero-length socket address caused buffer over-read in functions which receive socket address, for example ngx_sock_ntop(). Typically the over-read resulted in unexpected socket family followed by session close. Now a fake socket address is allocated instead of a zero-length client address.
author Roman Arutyunyan <arut@nginx.com>
date Fri, 01 Jun 2018 16:53:02 +0300
parents da9941c9b01b
children 52aacc8ddcc5
files src/event/ngx_event_accept.c
diffstat 1 files changed, 12 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/event/ngx_event_accept.c
+++ b/src/event/ngx_event_accept.c
@@ -448,6 +448,18 @@ ngx_event_recvmsg(ngx_event_t *ev)
             c->socklen = sizeof(ngx_sockaddr_t);
         }
 
+        if (c->socklen == 0) {
+
+            /*
+             * on Linux recvmsg() returns zero msg_namelen
+             * when receiving packets from unbound AF_UNIX sockets
+             */
+
+            c->socklen = sizeof(struct sockaddr);
+            ngx_memzero(&sa, sizeof(struct sockaddr));
+            sa.sockaddr.sa_family = ls->sockaddr->sa_family;
+        }
+
 #if (NGX_STAT_STUB)
         (void) ngx_atomic_fetch_add(ngx_stat_active, 1);
 #endif