struct sockaddr_un can be truncated.
When we have "struct sockaddr_un *s_un", we could not assume *s_un
points to a memory region which size is at least sizeof(*s_un).
Even worse, it may be shorter than sizeof(struct sockaddr) on some
systems.
MODIFY
mrbgems/mruby-socket/src/socket.c
mrbgems/mruby-socket/src/socket.c
@@ -214,8 +214,12 @@ mrb_addrinfo_unix_path(mrb_state *mrb, mrb_value self)
sastr = mrb_iv_get(mrb, self, mrb_intern_lit(mrb, "@sockaddr"));
if (((struct sockaddr *)RSTRING_PTR(sastr))->sa_family != AF_UNIX)
mrb_raise(mrb, E_SOCKET_ERROR, "need AF_UNIX address");
+ if (RSTRING_LEN(sastr) < offsetof(struct sockaddr_un, sun_path) + 1) {
+ return mrb_str_new(mrb, "", 0);
+ } else {
return mrb_str_new_cstr(mrb, ((struct sockaddr_un *)RSTRING_PTR(sastr))->sun_path);
}
+}
#endif
static mrb_value

struct sockaddr_un can be truncated.

When we have "struct sockaddr_un *s_un", we could not assume *s_un
points to a memory region which size is at least sizeof(*s_un).
Even worse, it may be shorter than sizeof(struct sockaddr) on some
systems.