kozorizki/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MEDIUM: server/event_hdl: memory overrun in _srv_event_hdl_prepare_inetaddr()

Browse Source 
As reported in GH #2358, #2359, #2360, #2361 and #2362: ipv6 address
handling may cause memory overrun due to struct in6_addr being handled
as sockaddr_in6 which is larger. Moreover, source variable wasn't properly
read from since the raw value was used as a pointer instead of pointing to
the actual variable's address.

This bug was introduced by 6fde37e046
("MINOR: server/event_hdl: add SERVER_INETADDR event")

Unfortunately for us, gcc didn't catch this and, this actually used to
"work" by accident since in6_addr struct is made of array so not passing
pointer explicitly still resolved to the proper starting address..
Hopefully this was caught by coverity so thanks to Ilya for that.

The fix is simple: we simply copy the whole in6_addr struct by accessing
it using a pointer and using the proper struct size for the copy.
This commit is contained in:
Aurelien DARRAGON 2023-11-25 16:39:19 +01:00 committed by Christopher Faulet
parent 1708d9f278
commit f638d4b1bc
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/server.c
View File

@ -268,9 +268,9 @@ void _srv_event_hdl_prepare_inetaddr(struct event_hdl_cb_data_server_inetaddr *c
}
else {
cb_data->safe.prev.family = AF_INET6;
memcpy(&cb_data->safe.prev.addr.v6.s6_addr,
((struct sockaddr_in6 *)prev_addr)->sin6_addr.s6_addr,
sizeof(struct sockaddr_in6));
memcpy(&cb_data->safe.prev.addr.v6,
&((struct sockaddr_in6 *)prev_addr)->sin6_addr,
sizeof(struct in6_addr));
}
cb_data->safe.prev.svc_port = prev_port;
@ -282,9 +282,9 @@ void _srv_event_hdl_prepare_inetaddr(struct event_hdl_cb_data_server_inetaddr *c
}
else {
cb_data->safe.next.family = AF_INET6;
memcpy(&cb_data->safe.next.addr.v6.s6_addr,
((struct sockaddr_in6 *)next_addr)->sin6_addr.s6_addr,
sizeof(struct sockaddr_in6));
memcpy(&cb_data->safe.next.addr.v6,
&((struct sockaddr_in6 *)next_addr)->sin6_addr,
sizeof(struct in6_addr));
}
cb_data->safe.next.svc_port = next_port;