diff options
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2017-03-23 15:31:56 +0400 |
|---|---|---|
| committer | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2017-04-29 18:29:58 +0200 |
| commit | 17eb587aeb492fe68f8130b027154ff0921fc0b4 (patch) | |
| tree | c1b92126c4d8f7063ef73ee4656293d78a870ab8 /slirp | |
| parent | f95cc8b6cc3ad8c4b687f305a978d67091c28138 (diff) | |
slirp: tftp, copy sockaddr_size
ASAN detects an "unknown-crash" when running pxe-test:
/ppc64/pxe/spapr-vlan: =================================================================
==7143==ERROR: AddressSanitizer: unknown-crash on address 0x7f6dcd298d30 at pc 0x55e22218830d bp 0x7f6dcd2989e0 sp 0x7f6dcd2989d0
READ of size 128 at 0x7f6dcd298d30 thread T2
#0 0x55e22218830c in tftp_session_allocate /home/elmarco/src/qq/slirp/tftp.c:73
#1 0x55e22218a1f8 in tftp_handle_rrq /home/elmarco/src/qq/slirp/tftp.c:289
#2 0x55e22218b54c in tftp_input /home/elmarco/src/qq/slirp/tftp.c:446
#3 0x55e2221833fe in udp6_input /home/elmarco/src/qq/slirp/udp6.c:82
#4 0x55e222137b17 in ip6_input /home/elmarco/src/qq/slirp/ip6_input.c:67
Address 0x7f6dcd298d30 is located in stack of thread T2 at offset 96 in frame
#0 0x55e222182420 in udp6_input /home/elmarco/src/qq/slirp/udp6.c:13
This frame has 3 object(s):
[32, 48) '<unknown>'
[96, 124) 'lhost' <== Memory access at offset 96 partially overflows this variable
[160, 200) 'save_ip' <== Memory access at offset 96 partially underflows this variable
The sockaddr_storage pointer is the sockaddr_in6 lhost on the
stack. Copy only the source addr size.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Diffstat (limited to 'slirp')
| -rw-r--r-- | slirp/tftp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/slirp/tftp.c b/slirp/tftp.c index 50e714807d..a9bc4bb1b6 100644 --- a/slirp/tftp.c +++ b/slirp/tftp.c @@ -70,7 +70,7 @@ static int tftp_session_allocate(Slirp *slirp, struct sockaddr_storage *srcsas, found: memset(spt, 0, sizeof(*spt)); - spt->client_addr = *srcsas; + memcpy(&spt->client_addr, srcsas, sockaddr_size(srcsas)); spt->fd = -1; spt->block_size = 512; spt->client_port = tp->udp.uh_sport; |