Skip to content

Commit

Permalink
socket: Prevent buffer under-read in nxt_inet_addr()
Browse files Browse the repository at this point in the history
This was found via ASan.

Given a listener address like ":" (or any address where the first
character is a colon) we can end up under-reading the addr->start
buffer here

  if (nxt_slow_path(*(buf + length - 1) == '.')) {

due to length (essentially the position of the ":" in the string) being
0.

Seeing as any address that starts with a ":" is invalid Unit config
wise, we should simply reject the address if length == 0 in
nxt_sockaddr_inet_parse().

Link: <https://clang.llvm.org/docs/AddressSanitizer.html>
Signed-off-by: Arjun <[email protected]>
[ Commit message - Andrew ]
Signed-off-by: Andrew Clayton <[email protected]>
  • Loading branch information
pkillarjun committed Aug 24, 2024
1 parent 69b830b commit 1e4c425
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions src/nxt_sockaddr.c
Original file line number Diff line number Diff line change
Expand Up @@ -732,6 +732,11 @@ nxt_sockaddr_inet_parse(nxt_mp_t *mp, nxt_str_t *addr)
length = p - addr->start;
}

if (length == 0) {
nxt_thread_log_error(NXT_LOG_ERR, "invalid address \"%V\"", addr);
return NULL;
}

inaddr = INADDR_ANY;

if (length != 1 || addr->start[0] != '*') {
Expand Down

0 comments on commit 1e4c425

Please sign in to comment.