From 0fac700aa429c53be2bcb63228eeadd8ce5d68ba Mon Sep 17 00:00:00 2001 From: ty Date: Wed, 23 Jun 2021 11:02:59 +0800 Subject: [PATCH 1/2] bpo-44493: Add missing terminated NUL in sockaddr_un's length - Linux: https://man7.org/linux/man-pages/man7/unix.7.html - *BSD: SUN_LEN --- .../next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst | 3 +++ Modules/socketmodule.c | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst diff --git a/Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst b/Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst new file mode 100644 index 00000000000000..390a7222bbf55f --- /dev/null +++ b/Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst @@ -0,0 +1,3 @@ +Add missing terminated NUL in sockaddr_un's length + +This was potentially observable when using non-abstract AF_UNIX datagram sockets to processes written in another programming language. diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c index 9233430667c2fe..267a719bb9e5f6 100644 --- a/Modules/socketmodule.c +++ b/Modules/socketmodule.c @@ -1683,6 +1683,8 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args, "AF_UNIX path too long"); goto unix_out; } + + *len_ret = path.len + offsetof(struct sockaddr_un, sun_path); } else #endif /* linux */ @@ -1694,10 +1696,12 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args, goto unix_out; } addr->sun_path[path.len] = 0; + + *len_ret = path.len + offsetof(struct sockaddr_un, sun_path) + 1; /* including the tailing NUL */ } addr->sun_family = s->sock_family; memcpy(addr->sun_path, path.buf, path.len); - *len_ret = path.len + offsetof(struct sockaddr_un, sun_path); + retval = 1; unix_out: PyBuffer_Release(&path); From a20a659d74bf7faa53dfdb9a12617c7cfe8f7cbd Mon Sep 17 00:00:00 2001 From: zonyitoo Date: Sat, 26 Mar 2022 22:51:33 +0800 Subject: [PATCH 2/2] Moved comment to the separated line --- Modules/socketmodule.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c index 267a719bb9e5f6..f2d4ae686ec64b 100644 --- a/Modules/socketmodule.c +++ b/Modules/socketmodule.c @@ -1697,7 +1697,8 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args, } addr->sun_path[path.len] = 0; - *len_ret = path.len + offsetof(struct sockaddr_un, sun_path) + 1; /* including the tailing NUL */ + /* including the tailing NUL */ + *len_ret = path.len + offsetof(struct sockaddr_un, sun_path) + 1; } addr->sun_family = s->sock_family; memcpy(addr->sun_path, path.buf, path.len);