Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed Buffer Overflow Issue #293

Closed
wants to merge 3 commits into from
Closed

Fixed Buffer Overflow Issue #293

wants to merge 3 commits into from

Conversation

@raminfp
Copy link

raminfp commented Apr 2, 2019

Hi,

Description

less /usr/include/linux/un.h
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef _LINUX_UN_H
#define _LINUX_UN_H

#include <linux/socket.h>

#define UNIX_PATH_MAX   108

struct sockaddr_un {
        __kernel_sa_family_t sun_family; /* AF_UNIX */
        char sun_path[UNIX_PATH_MAX];   /* pathname */
};

#define SIOCUNIXFILE (SIOCPROTOPRIVATE + 0) /* open a socket file with O_PATH */

#endif /* _LINUX_UN_H */

We see char buffer define sun_path[UNIX_PATH_MAX]; /* pathname */ of sockaddr_un that UNIX_PATH_MAX=108

Overflow code

strcpy(saun.sun_path, sockFile);

There isn't any check if length sockFile greater than length saun.sun_path

raminfp added 3 commits Apr 2, 2019
@bk138

This comment has been minimized.

Copy link
Member

bk138 commented Apr 6, 2019

Closing in favour of 3fd0397

@bk138 bk138 closed this Apr 6, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.