nix icon indicating copy to clipboard operation
nix copied to clipboard

Published 20 hours ago • verified publisher icon nix-rust

Fix UB in the SO_TYPE sockopt

Open asomers opened this issue 3 years ago • 3 comments
trafficstars

When reading a value into an enum from getsockopt, we must validate it. Failing to do so can lead to UB for example with SOCK_PACKET on Linux.

Perform the validation in GetSockOpt::get. Currently SockType is the only type that requires validation.

Fixes #1819

asomers avatar Sep 17 '22 17:09 asomers

I fixed the formatting. And rather than figure out how to determine whether a Fuchsia process can create raw sockets, I'm just skipping that test on Fuchsia.

asomers avatar Sep 17 '22 17:09 asomers

@ahcodedthat does this patch solve your original problem?

asomers avatar Sep 17 '22 18:09 asomers

Yes, that works. The example program now just fails cleanly with EINVAL instead of segfaulting. 👍

I suggest mentioning in the documentation for nix::sys::socket::sockopt::SockType that it will fail with EINVAL if the socket type is unknown.

It might also be wise to use a different error code, since the getsockopt system call can fail with EINVAL for other reasons too. ESOCKTNOSUPPORT seems best, but it doesn't exist on cfg(target_os = "haiku"), so consider using EPROTONOSUPPORT instead.

ahcodedthat avatar Sep 17 '22 23:09 ahcodedthat

@rtzoeller I stupidly forgot about this PR when I made the 0.26.0 release a few minutes ago.

asomers avatar Nov 29 '22 06:11 asomers

bors r+

rtzoeller avatar Nov 29 '22 06:11 rtzoeller

Build succeeded:

bors[bot] avatar Nov 29 '22 06:11 bors[bot]