Skip to content

Commit ba33dd4

Browse files
committed
TCP input: fix memory access issue
The address was improperly stored in a sockaddr type, which was then access as a sockaddr_in6, even though sizeof(sockaddr) < sizeof(sockaddr_in6). This resulted in stack smashing. The proper type to use that can contain all addresses is sockaddr_storage. Fixes issue #107
1 parent f5e20e9 commit ba33dd4

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

src/plugins/input/tcp/src/Acceptor.cpp

+6-5
Original file line numberDiff line numberDiff line change
@@ -74,9 +74,10 @@ void Acceptor::add_address(IpAddress &adr, uint16_t port, bool ipv6_only) {
7474
}
7575

7676
UniqueFd Acceptor::bind_address(IpAddress &addr, uint16_t port, bool ipv6_only) {
77-
sockaddr saddr{};
78-
auto v4 = reinterpret_cast<sockaddr_in *>(&saddr);
79-
auto v6 = reinterpret_cast<sockaddr_in6 *>(&saddr);
77+
sockaddr_storage saddr_storage{};
78+
auto *saddr = reinterpret_cast<sockaddr *>(&saddr_storage);
79+
auto *v4 = reinterpret_cast<sockaddr_in *>(&saddr_storage);
80+
auto *v6 = reinterpret_cast<sockaddr_in6 *>(&saddr_storage);
8081
size_t addr_len;
8182

8283
if (addr.version == IpVersion::IP4) {
@@ -94,7 +95,7 @@ UniqueFd Acceptor::bind_address(IpAddress &addr, uint16_t port, bool ipv6_only)
9495

9596
const char *err_str;
9697

97-
UniqueFd sd(socket(saddr.sa_family, SOCK_STREAM, 0));
98+
UniqueFd sd(socket(saddr->sa_family, SOCK_STREAM, 0));
9899
if (!sd) {
99100
ipx_strerror(errno, err_str);
100101
throw std::runtime_error("Failed to create socket: " + std::string(err_str));
@@ -128,7 +129,7 @@ UniqueFd Acceptor::bind_address(IpAddress &addr, uint16_t port, bool ipv6_only)
128129
std::array<char, INET6_ADDRSTRLEN> addr_str{};
129130
inet_ntop(static_cast<int>(addr.version), &addr.v6, addr_str.begin(), INET6_ADDRSTRLEN);
130131

131-
if (bind(sd.get(), &saddr, addr_len) == -1) {
132+
if (bind(sd.get(), saddr, addr_len) == -1) {
132133
ipx_strerror(errno, err_str);
133134
throw std::runtime_error(
134135
"Failed to bind to socket (local IP: "

0 commit comments

Comments
 (0)