[MINOR] cfgparse: Check whether the path given for the stats socket actually fits into the sockaddr_un structure to avoid truncation.
while working further on the changes to allow for dynamic
adding/removing of backend servers we noticed a potential problem: the
path given for the 'stats socket' global option may get truncated when
copying it into the sockaddr_un.sun_path field.
Attached patch checks the length, and reports an error if truncation
would happen.
This issue was noticed by Joerg Sonnenberger <joerg@NetBSD.org>.
diff --git a/src/dumpstats.c b/src/dumpstats.c
index a45d40a..980b284 100644
--- a/src/dumpstats.c
+++ b/src/dumpstats.c
@@ -151,7 +151,7 @@
{
args++;
if (!strcmp(args[0], "socket")) {
- struct sockaddr_un su;
+ struct sockaddr_un *su;
int cur_arg;
if (*args[1] == 0) {
@@ -164,10 +164,12 @@
return -1;
}
- su.sun_family = AF_UNIX;
- strncpy(su.sun_path, args[1], sizeof(su.sun_path));
- su.sun_path[sizeof(su.sun_path) - 1] = 0;
- memcpy(&global.stats_sock.addr, &su, sizeof(su)); // guaranteed to fit
+ su = str2sun(args[1]);
+ if (!su) {
+ snprintf(err, errlen, "'stats socket' path would require truncation");
+ return -1;
+ }
+ memcpy(&global.stats_sock.addr, su, sizeof(struct sockaddr_un)); // guaranteed to fit
if (!global.stats_fe) {
if ((global.stats_fe = alloc_stats_fe("GLOBAL")) == NULL) {