diff options
author | Michael Santos <michael.santos@gmail.com> | 2010-07-23 11:29:20 -0400 |
---|---|---|
committer | Björn Gustavsson <bjorn@erlang.org> | 2010-07-26 14:42:31 +0200 |
commit | d61d41e235bc464a15925e6fd1b7e9138477d3b3 (patch) | |
tree | c1525cc5a4c0ba1cd52bf281716c710900754b31 /erts | |
parent | 227d3f3ff078426ae79b7f2313bc8be915c5e252 (diff) | |
download | otp-d61d41e235bc464a15925e6fd1b7e9138477d3b3.tar.gz otp-d61d41e235bc464a15925e6fd1b7e9138477d3b3.tar.bz2 otp-d61d41e235bc464a15925e6fd1b7e9138477d3b3.zip |
inet: fix getservbyname buffer overflow
The byte holding the length of the interface name for the getservbyname/2
function is used in a signed context and can become negative, causing
the buffer to be overrun. Make the same change for getservbyport/2.
Test case:
inet:getservbyname(list_to_atom(lists:flatten(lists:duplicate(128, "x"))), tcp).
Diffstat (limited to 'erts')
-rw-r--r-- | erts/emulator/drivers/common/inet_drv.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/erts/emulator/drivers/common/inet_drv.c b/erts/emulator/drivers/common/inet_drv.c index 87dc63509d..8e312c0292 100644 --- a/erts/emulator/drivers/common/inet_drv.c +++ b/erts/emulator/drivers/common/inet_drv.c @@ -6847,13 +6847,13 @@ static int inet_ctl(inet_descriptor* desc, int cmd, char* buf, int len, if (len < 2) return ctl_error(EINVAL, rbuf, rsize); - n = buf[0]; buf++; len--; + n = get_int8(buf); buf++; len--; if (n >= len) /* the = sign makes the test inklude next length byte */ return ctl_error(EINVAL, rbuf, rsize); memcpy(namebuf, buf, n); namebuf[n] = '\0'; len -= n; buf += n; - n = buf[0]; buf++; len--; + n = get_int8(buf); buf++; len--; if (n > len) return ctl_error(EINVAL, rbuf, rsize); memcpy(protobuf, buf, n); @@ -6876,7 +6876,7 @@ static int inet_ctl(inet_descriptor* desc, int cmd, char* buf, int len, port = get_int16(buf); port = sock_htons(port); buf += 2; - n = buf[0]; buf++; len -= 3; + n = get_int8(buf); buf++; len -= 3; if (n > len) return ctl_error(EINVAL, rbuf, rsize); memcpy(protobuf, buf, n); |