Skip to content

Commit

Permalink
Check for max length before derefing by length.
Browse files Browse the repository at this point in the history
Coverity CID 135025 (#1 of 1): Out-of-bounds read (OVERRUN)
29. overrun-local: Overrunning array addr.sun_path of 108 bytes at byte offset 108 using index addr_len (which evaluates to 108).
 864                for (addr_len = 0; addr.sun_path[addr_len]
 28. incr: Incrementing addr_len. The value of addr_len may now be up to 108.
 865                     && addr_len < maxlen; addr_len++);

Reported upstream as

https://rt.cpan.org/Ticket/Display.html?id=111707
  • Loading branch information
jhi committed Mar 1, 2016
1 parent 00d484c commit 2d703be
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions cpan/Socket/Socket.xs
Original file line number Diff line number Diff line change
Expand Up @@ -861,8 +861,8 @@ unpack_sockaddr_un(sun_sv)
# else
const int maxlen = (int)sizeof(addr.sun_path);
# endif
for (addr_len = 0; addr.sun_path[addr_len]
&& addr_len < maxlen; addr_len++);
for (addr_len = 0; addr_len < maxlen
&& addr.sun_path[addr_len]; addr_len++);
}

ST(0) = sv_2mortal(newSVpvn(addr.sun_path, addr_len));
Expand Down

0 comments on commit 2d703be

Please sign in to comment.