Skip to content

Darwin: fix sockaddr_un overflow in makeAddressUnix for long paths - #230

Merged
swhitty merged 1 commit into
swhitty:mainfrom
ianegordon:ian/tvt-1063-darwin-makeaddressunix-overflows-sockaddr_un-for-paths-102
Jul 22, 2026
Merged

Darwin: fix sockaddr_un overflow in makeAddressUnix for long paths#230
swhitty merged 1 commit into
swhitty:mainfrom
ianegordon:ian/tvt-1063-darwin-makeaddressunix-overflows-sockaddr_un-for-paths-102

Conversation

@ianegordon

Copy link
Copy Markdown
Contributor

Summary

  • Socket.makeAddressUnix(path:) on Darwin clamped the path to 104 bytes but bounded strncpy by sun_len (up to 106), writing past the end of sun_path — which Darwin <sys/un.h> declares as char sun_path[104]. Paths ≥ 102 bytes overflowed the struct.
  • The path is now truncated to 103 bytes and sun_path is always NUL-terminated, so String(cString:) and unlink() read back a valid C string.
  • Fixes the same off-by-one in the existing maximumPathLengthForUnixDomainSocket test, which computed the capacity from struct arithmetic that omitted sun_len and copied 105 bytes into the 104-byte field (caught by AddressSanitizer).

Test plan

  • Added round-trip tests for a max-length (103-byte) path and an overlong path that must truncate without overflow.
  • swift test --filter SocketAddressTests — 20/20 pass.
  • swift test --sanitize address --filter SocketAddressTests — clean, no ASan reports.

🤖 Generated with Claude Code

Truncate paths to 103 bytes and always NUL-terminate sun_path, which
Darwin <sys/un.h> declares as char sun_path[104]. Previously strncpy
was bounded by sun_len (up to 106), writing past the end of the struct.

Also fix the same off-by-one in maximumPathLengthForUnixDomainSocket,
which copied 105 bytes into the 104-byte field (caught by ASan), and
add round-trip tests for max-length and overlong paths.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@codecov

codecov Bot commented Jul 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.00%. Comparing base (4e246d3) to head (bb98152).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #230      +/-   ##
==========================================
+ Coverage   92.88%   93.00%   +0.11%     
==========================================
  Files          71       71              
  Lines        3727     3730       +3     
==========================================
+ Hits         3462     3469       +7     
+ Misses        265      261       -4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

@swhitty
swhitty merged commit ac24c58 into swhitty:main Jul 22, 2026
12 of 13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants