https://github.com/python/cpython/commit/dae09c2b819c2683ad870733451c050b59c... commit: dae09c2b819c2683ad870733451c050b59c3eb93 branch: 3.9 author: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> committer: gpshead <greg@krypto.org> date: 2022-03-28T13:03:18-07:00 summary: [3.9] bpo-44493: Add missing terminated NUL in sockaddr_un's length (GH-26866) (GH-32140) (GH-32156) Add missing terminated NUL in sockaddr_un's length - Linux: https://man7.org/linux/man-pages/man7/unix.7.html - *BSD: SUN_LEN (cherry picked from commit f6b3a07b7df60dc04d0260169ffef6e9796a2124) Co-authored-by: ty <zonyitoo@users.noreply.github.com> Automerge-Triggered-By: GH:gpshead (cherry picked from commit 5944807b09717d43bb017f700e8c451dd07199ed) Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> files: A Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst M Modules/socketmodule.c diff --git a/Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst b/Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst new file mode 100644 index 0000000000000..390a7222bbf55 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst @@ -0,0 +1,3 @@ +Add missing terminated NUL in sockaddr_un's length + +This was potentially observable when using non-abstract AF_UNIX datagram sockets to processes written in another programming language. diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c index a22060d399082..6d6c92e4c95d1 100644 --- a/Modules/socketmodule.c +++ b/Modules/socketmodule.c @@ -1722,6 +1722,8 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args, "AF_UNIX path too long"); goto unix_out; } + + *len_ret = path.len + offsetof(struct sockaddr_un, sun_path); } else #endif /* linux */ @@ -1733,10 +1735,13 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args, goto unix_out; } addr->sun_path[path.len] = 0; + + /* including the tailing NUL */ + *len_ret = path.len + offsetof(struct sockaddr_un, sun_path) + 1; } addr->sun_family = s->sock_family; memcpy(addr->sun_path, path.buf, path.len); - *len_ret = path.len + offsetof(struct sockaddr_un, sun_path); + retval = 1; unix_out: PyBuffer_Release(&path);