[3.9] bpo-44493: Add missing terminated NUL in sockaddr_un's length (GH-26866) (GH-32140) (GH-32156)

miss-islington · web-flow · commit dae09c2b819c · 2022-03-28T13:03:18.000-07:00
Add missing terminated NUL in sockaddr_un's length - Linux: https://man7.org/linux/man-pages/man7/unix.7.html - *BSD: SUN_LEN (cherry picked from commit f6b3a07) Co-authored-by: ty <zonyitoo@users.noreply.github.com> Automerge-Triggered-By: GH:gpshead (cherry picked from commit 5944807) Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
diff --git a/Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst b/Misc/NEWS.d/next/Library/2021-07-26-10-46-49.bpo-44493.xp3CRH.rst
@@ -0,0 +1,3 @@
+Add missing terminated NUL in sockaddr_un's length
+
+This was potentially observable when using non-abstract AF_UNIX datagram sockets to processes written in another programming language.
diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
@@ -1722,6 +1722,8 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args,
                                 "AF_UNIX path too long");
                 goto unix_out;
             }
+
+            *len_ret = path.len + offsetof(struct sockaddr_un, sun_path);
         }
         else
 #endif /* linux */
@@ -1733,10 +1735,13 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args,
                 goto unix_out;
             }
             addr->sun_path[path.len] = 0;
+
+            /* including the tailing NUL */
+            *len_ret = path.len + offsetof(struct sockaddr_un, sun_path) + 1;
         }
         addr->sun_family = s->sock_family;
         memcpy(addr->sun_path, path.buf, path.len);
-        *len_ret = path.len + offsetof(struct sockaddr_un, sun_path);
+        
         retval = 1;
     unix_out:
         PyBuffer_Release(&path);

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+Add missing terminated NUL in sockaddr_un's length`
	`2`	`+`
	`3`	`+This was potentially observable when using non-abstract AF_UNIX datagram sockets to processes written in another programming language.`
Original file line number	Diff line number	Diff line change
`@@ -1722,6 +1722,8 @@ getsockaddrarg(PySocketSockObject s, PyObject args,`
`1722`	`1722`	`"AF_UNIX path too long");`
`1723`	`1723`	`goto unix_out;`
`1724`	`1724`	`}`
	`1725`	`+`
	`1726`	`+ *len_ret = path.len + offsetof(struct sockaddr_un, sun_path);`
`1725`	`1727`	`}`
`1726`	`1728`	`else`
`1727`	`1729`	`#endif /* linux */`
`@@ -1733,10 +1735,13 @@ getsockaddrarg(PySocketSockObject s, PyObject args,`
`1733`	`1735`	`goto unix_out;`
`1734`	`1736`	`}`
`1735`	`1737`	`addr->sun_path[path.len] = 0;`
	`1738`	`+`
	`1739`	`+ /* including the tailing NUL */`
	`1740`	`+ *len_ret = path.len + offsetof(struct sockaddr_un, sun_path) + 1;`
`1736`	`1741`	`}`
`1737`	`1742`	`addr->sun_family = s->sock_family;`
`1738`	`1743`	`memcpy(addr->sun_path, path.buf, path.len);`
`1739`		`- *len_ret = path.len + offsetof(struct sockaddr_un, sun_path);`
	`1744`	`+`
`1740`	`1745`	`retval = 1;`
`1741`	`1746`	`unix_out:`
`1742`	`1747`	`PyBuffer_Release(&path);`