details: http://hg.nginx.org/nginx/rev/3f94a0fc05cf
branches:
changeset: 6731:3f94a0fc05cf
user: Maxim Dounin <mdounin@mdounin.ru>
date: Mon Oct 10 16:15:41 2016 +0300
description:
Core: sockaddr lengths now respected by ngx_cmp_sockaddr().

Linux can return AF_UNIX sockaddrs with partially filled sun_path,
resulting in spurious comparison failures and failed binary upgrades.
Added proper checking of the lengths provided.

Reported by Jan Seda,
http://mailman.nginx.org/pipermail/nginx-devel/2016-September/008832.html.

diffstat:

src/core/ngx_inet.c | 19 +++++++++++++------
1 files changed, 13 insertions(+), 6 deletions(-)

diffs (39 lines):

diff --git a/src/core/ngx_inet.c b/src/core/ngx_inet.c
--- a/src/core/ngx_inet.c
+++ b/src/core/ngx_inet.c
@@ -1364,6 +1364,7 @@ ngx_cmp_sockaddr(struct sockaddr *sa1, s
struct sockaddr_in6 *sin61, *sin62;
#endif
#if (NGX_HAVE_UNIX_DOMAIN)
+ size_t len;
struct sockaddr_un *saun1, *saun2;
#endif

@@ -1393,15 +1394,21 @@ ngx_cmp_sockaddr(struct sockaddr *sa1, s
#if (NGX_HAVE_UNIX_DOMAIN)
case AF_UNIX:

- /* TODO length */
-
saun1 = (struct sockaddr_un *) sa1;
saun2 = (struct sockaddr_un *) sa2;

- if (ngx_memcmp(&saun1->sun_path, &saun2->sun_path,
- sizeof(saun1->sun_path))
- != 0)
- {
+ if (slen1 < slen2) {
+ len = slen1 - offsetof(struct sockaddr_un, sun_path);
+
+ } else {
+ len = slen2 - offsetof(struct sockaddr_un, sun_path);
+ }
+
+ if (len > sizeof(saun1->sun_path)) {
+ len = sizeof(saun1->sun_path);
+ }
+
+ if (ngx_memcmp(&saun1->sun_path, &saun2->sun_path, len) != 0) {
return NGX_DECLINED;
}


_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel