[SSSD] [PATCH] Properly null-terminate socket path

Stephen Gallagher sgallagh at redhat.com
Mon Jun 14 14:54:13 UTC 2010


On 06/14/2010 10:48 AM, Dmitri Pal wrote:
> Jakub Hrozek wrote:
>> On 06/14/2010 04:13 PM, Stephen Gallagher wrote:
>>> On 06/14/2010 10:10 AM, Stephen Gallagher wrote:
>>>> https://fedorahosted.org/sssd/ticket/540
>>>>
>>>> It was unlikely, but if the path to the socket file exceeded 108
>>>> characters, this strncpy would be unterminated and the results could be
>>>> unexpected. This was not an exploitable vulnerability.
>>>>
>>> I forgot to mention, this patch should apply to both master and
>> sssd-1-2.
>>
>>
>> ACK
>
> I am not sure... From man page:
>
> sun_family always contains AF_UNIX. sun_path contains the
> zero-terminated pathname of the
> socket in the file system. If sun_path starts with a null byte (’’ ’),
> then it refers to the
> abstract namespace maintained by the Unix protocol module. The socket’s
> address in this
> namespace is given by the rest of the bytes in sun_path. Note that names
> in the abstract
> namespace are not zero-terminated.
>
> So the right approach would probably be memcpy of the sizeof rather than
> strncpy.
> It really depends whether we trust the claim above that it is NULL
> terminated and we can guarantee that we are not going to ever get
> addresses in the abstract namespace.
>

I'm not sure where you're going with this. We're strncpy()ing FROM 
rctx->sock_name (which we ourselves construct and can guarantee is 
null-terminated) into addr.sun_path. What we're doing here is making 
sure that if rctx->sock_name exceeds the size of addr.sun_path, then we 
ensure that it is null-terminated.

We're guaranteed that the first byte of addr.sun_path will never be NULL 
here, so there's no concern about the abstract namespace.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list