Date: Fri, 26 Oct 2001 17:03:13 +0600 (YEKST) From: stas@grumbler.org To: FreeBSD-gnats-submit@freebsd.org Subject: bin/31507: Risk of buffer overflow in struct sockaddr_un Message-ID: <200110261103.RAA06245@grumbler.org>
next in thread | raw e-mail | index | archive | help
>Number: 31507
>Category: bin
>Synopsis: Risk of buffer overflow in struct sockaddr_un
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Fri Oct 26 04:30:01 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Stas Degteff
>Release: FreeBSD 4.1-RELEASE i386
>Organization:
>Environment:
FreeBSD 4.* (4.0-STABLE, 4.0-CURRENT & previous version)
>Description:
In the sys/un.h sockaddr_un declared as:
/*
* Definitions for UNIX IPC domain.
*/
struct sockaddr_un {
u_char sun_len; /* sockaddr len including null */
u_char sun_family; /* AF_UNIX */
char sun_path[104]; /* path name (gag) */
};
In array size present numerical constant vith value very less than the PATH_MAX
constant.
>How-To-Repeat:
>Fix:
Apply this path #ifdef MAX_SUN_PATHd.org/pub/FreeBSD/branches/-current/src/sys/sys/un.h:
--- un.h.orig Fri Oct 26 16:17:01 2001
+++ un.h Fri Oct 26 16:17:01 2001
@@ -38,4 +38,5 @@
#define _SYS_UN_H_
+#define MAX_SUN_PATH 104
/*
* Definitions for UNIX IPC domain.
@@ -44,5 +45,5 @
u_char sun_len; /* sockaddr len including null */
u_char sun_family; /* AF_UNIX */
- char sun_path[104]; /* path name (gag) */
+ char sun_path[MAX_SUN_PATH]; /* path name (gag) */
};
There programmer may use folowing code:
struct sockaddr_un server;
#ifdef MAX_SUN_PATH
strncpy(server.sun_path, file_fifo, MAX_SUN_PATH);
#else
strncpy(server.sun_path, file_fifo, 104); /* or other platform-depended value */
#endif
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200110261103.RAA06245>