Buffer overflows

[ryandesign]

When compiling the latest master on macOS High Sierra, clang points out a couple buffer overflows in your code:

tcp_subr.c:341:4: warning: '__builtin___strncpy_chk' will always overflow destination buffer [-Wbuiltin-memcpy-chk-size]
                        strncpy(addr.sun_path,path,UNIX_PATH_MAX);
                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/secure/_string.h:124:3: note: expanded from macro 'strncpy'
                __builtin___strncpy_chk (dest, __VA_ARGS__, __darwin_obsz (dest))
                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Here, it looks like you're copying UNIX_PATH_MAX bytes to the sun_path field of a struct sockaddr_un, and in tcp2unix.h you've defined UNIX_PATH_MAX as 108, which as far as I can tell is correct for Linux systems, but based on cursory research, it seems that different operating systems use different sizes for this field, down to as small as 92 bytes. On my macOS system, the sun_path field's length is 104 bytes.

vder_packet.c:207:5: warning: '__builtin___memcpy_chk' will always overflow destination buffer [-Wbuiltin-memcpy-chk-size]
                                memcpy(foot, footprint(packet), sizeof(struct iphdr) + 8);
                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/secure/_string.h:62:3: note: expanded from macro 'memcpy'
                __builtin___memcpy_chk (dest, __VA_ARGS__, __darwin_obsz0 (dest))
                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In this case, I think the problem is that you're allocating the variable foot based on the size of a pointer rather than the size of the struct that the pointer points to.

[ryandesign]

What about the sun_path length issue? One solution would be to reduce UNIX_PATH_MAX to 92, even if Linux and some other systems can use larger values. I don't know how inconvenient that would be for users of those systems. I don't know if there's a way to detect what the maximum length of sun_path is.

[danielinux]

@ryandesign I see the problem, but I don't have a Mac to properly test the fix. Would you be so kind to review my PR that aims to fix this?