Guard get_default_if_name against empty or unparseable /proc/net/route#17
Open
acts-1631 wants to merge 1 commit into
Open
Guard get_default_if_name against empty or unparseable /proc/net/route#17acts-1631 wants to merge 1 commit into
acts-1631 wants to merge 1 commit into
Conversation
get_default_if_name reads /proc/net/route looking for the default route entry. The fallback block that runs when no default route is found dereferences the uninitialized 'field' pointer and copies the uninitialized 'line' buffer into the caller's 16-byte destination. Two failure modes exist: - An empty /proc/net/route leaves both 'field' and 'line' entirely uninitialized; *field writes to an arbitrary stack location and strcpy(name, line) overflows the 16-byte destination. - A file with lines but no tabs leaves 'field' NULL from the last strchr call; *field = '\0' is a null pointer dereference (crash). Initialize field to NULL and line[0] to '\0' before the loop. Guard the fallback block so it only runs when a valid last line was seen. When the guard fails, set name[0] = '\0' so the caller InterfaceAddress() keeps its 127.0.0.1 fallback instead of reading the uninitialized gw_if buffer and entering the getifaddrs block with a garbage interface name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
get_default_if_name reads /proc/net/route looking for the default
route. The fallback block that runs when no default route is found
dereferences the uninitialized 'field' pointer and copies the
uninitialized 'line' buffer into the caller's 16-byte destination.
Two failure modes exist:
uninitialized; *field writes to an arbitrary stack location and
strcpy(name, line) overflows the 16-byte destination.
strchr call; *field = '\0' is a null pointer dereference.
This initializes field to NULL and line[0] to '\0' before the loop,
guards the fallback block so it only runs when a valid last line was
seen, and sets name[0] = '\0' when the guard fails so the caller
InterfaceAddress() keeps its 127.0.0.1 fallback instead of reading
the uninitialized gw_if buffer.