undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

compat/inet_ntop: fix off-by-one in inet_ntop4

Browse Source 
Our compat inet_ntop4 function writes to a temporary buffer
with snprintf, and then uses strcpy to put the result into
the final "dst" buffer. We check the return value of
snprintf against the size of "dst", but fail to account for
the NUL terminator. As a result, we may overflow "dst" with
a single NUL. In practice, this doesn't happen because the
output of inet_ntop is limited, and we provide buffers that
are way oversized.

We can fix the off-by-one check easily, but while we are
here let's also use strlcpy for increased safety, just in
case there are other bugs lurking.

As a side note, this compat code seems to be BSD-derived.
Searching for "vixie inet_ntop" turns up NetBSD's latest
version of the same code, which has an identical fix (and
switches to strlcpy, too!).

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Jeff King 2015-09-24 17:06:06 -04:00 committed by Junio C Hamano
parent 04724222d5
commit db85a8a9c2
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
compat/inet_ntop.c
View File

@ -53,11 +53,11 @@ inet_ntop4(const u_char *src, char *dst, size_t size)
nprinted = snprintf(tmp, sizeof(tmp), fmt, src[0], src[1], src[2], src[3]); nprinted = snprintf(tmp, sizeof(tmp), fmt, src[0], src[1], src[2], src[3]);
if (nprinted < 0) if (nprinted < 0)
return (NULL); /* we assume "errno" was set by "snprintf()" */ return (NULL); /* we assume "errno" was set by "snprintf()" */
if ((size_t)nprinted > size) { if ((size_t)nprinted >= size) {
errno = ENOSPC; errno = ENOSPC;
return (NULL); return (NULL);
} }
strcpy(dst, tmp); strlcpy(dst, tmp, size);
return (dst); return (dst);
} }
@ -154,7 +154,7 @@ inet_ntop6(const u_char *src, char *dst, size_t size)
errno = ENOSPC; errno = ENOSPC;
return (NULL); return (NULL);
} }
strcpy(dst, tmp); strlcpy(dst, tmp, size);
return (dst); return (dst);
} }
#endif #endif