MyFavMirrors/owntone-server
1
0
Fork 0
mirror of https://github.com/owntone/owntone-server.git synced 2024-12-28 08:05:56 -05:00
Code Issues Packages Projects Releases Wiki Activity

[misc] Fix use-after-free in net_bind()

Browse Source 
Thanks to Ba Jinsheng for reporting this bug
This commit is contained in:
ejurgensen 2021-07-31 00:55:48 +02:00
parent dc8e66109e
commit 246d8ae0ce
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/misc.c
View File

@ -251,6 +251,8 @@ net_bind(short unsigned *port, int type, const char *log_service_name)
struct addrinfo hints = { 0 }; struct addrinfo hints = { 0 };
struct addrinfo *servinfo; struct addrinfo *servinfo;
struct addrinfo *ptr; struct addrinfo *ptr;
union net_sockaddr naddr = { 0 };
socklen_t naddr_len = sizeof(naddr);
const char *cfgaddr; const char *cfgaddr;
char addr[INET6_ADDRSTRLEN]; char addr[INET6_ADDRSTRLEN];
char strport[8]; char strport[8];
@ -314,16 +316,22 @@ net_bind(short unsigned *port, int type, const char *log_service_name)
goto error; goto error;
} }
// Get the port that was assigned // Get our address (as string) and the port that was assigned (necessary when
ret = getsockname(fd, ptr->ai_addr, &ptr->ai_addrlen); // caller didn't specify a port)
ret = getsockname(fd, &naddr.sa, &naddr_len);
if (ret < 0) if (ret < 0)
{ {
DPRINTF(E_LOG, L_MISC, "Could not find address of service '%s': %s\n", log_service_name, strerror(errno)); DPRINTF(E_LOG, L_MISC, "Error finding address of service '%s': %s\n", log_service_name, strerror(errno));
goto error;
}
else if (naddr_len > sizeof(naddr))
{
DPRINTF(E_LOG, L_MISC, "Unexpected address length of service '%s'\n", log_service_name);
goto error; goto error;
} }
net_port_get(port, (union net_sockaddr *)ptr->ai_addr); net_port_get(port, &naddr);
net_address_get(addr, sizeof(addr), (union net_sockaddr *)ptr->ai_addr); net_address_get(addr, sizeof(addr), &naddr);
DPRINTF(E_DBG, L_MISC, "Service '%s' bound to %s, port %hu, socket %d\n", log_service_name, addr, *port, fd); DPRINTF(E_DBG, L_MISC, "Service '%s' bound to %s, port %hu, socket %d\n", log_service_name, addr, *port, fd);