mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 10:40:03 +01:00
vchan-socket-proxy: Ensure UNIX path NUL terminated
Check the socket path length to ensure sun_path is NUL terminated. This was spotted by Citrix's Coverity. Also use strcpy to avoid a warning "'__builtin_strncpy' specified bound 108 equals destination size [-Werror=stringop-truncation]" flagged by gcc 10. Signed-off-by: Jason Andryuk <jandryuk@gmail.com> Acked-by: Wei Liu <wl@xen.org> Reviewed-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Release-acked-by: Paul Durrant <paul@xen.org>
This commit is contained in:
1 parent
ed69c2ecaf
commit
2c8ac47d4e
1 file changed
+14
-2
@@ -148,12 +148,18 @@ static int connect_socket(const char *path_or_fd) {
|
||||
return fd;
|
||||
}
|
||||
|
||||
if (strlen(path_or_fd) >= sizeof(addr.sun_path)) {
|
||||
fprintf(stderr, "UNIX socket path \"%s\" too long (%zd >= %zd)\n",
|
||||
path_or_fd, strlen(path_or_fd), sizeof(addr.sun_path));
|
||||
return -1;
|
||||
}
|
||||
|
||||
fd = socket(AF_UNIX, SOCK_STREAM, 0);
|
||||
if (fd == -1)
|
||||
return -1;
|
||||
|
||||
addr.sun_family = AF_UNIX;
|
||||
strncpy(addr.sun_path, path_or_fd, sizeof(addr.sun_path));
|
||||
strcpy(addr.sun_path, path_or_fd);
|
||||
if (connect(fd, (const struct sockaddr *)&addr, sizeof(addr)) == -1) {
|
||||
close(fd);
|
||||
return -1;
|
||||
@@ -174,13 +180,19 @@ static int listen_socket(const char *path_or_fd) {
|
||||
return fd;
|
||||
}
|
||||
|
||||
if (strlen(path_or_fd) >= sizeof(addr.sun_path)) {
|
||||
fprintf(stderr, "UNIX socket path \"%s\" too long (%zd >= %zd)\n",
|
||||
path_or_fd, strlen(path_or_fd), sizeof(addr.sun_path));
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* if not a number, assume a socket path */
|
||||
fd = socket(AF_UNIX, SOCK_STREAM, 0);
|
||||
if (fd == -1)
|
||||
return -1;
|
||||
|
||||
addr.sun_family = AF_UNIX;
|
||||
strncpy(addr.sun_path, path_or_fd, sizeof(addr.sun_path));
|
||||
strcpy(addr.sun_path, path_or_fd);
|
||||
if (bind(fd, (const struct sockaddr *)&addr, sizeof(addr)) == -1) {
|
||||
close(fd);
|
||||
return -1;
|
||||
|
||||