Skip to content

Commit

Permalink
unix: fix double copy in (*SockaddrALG).sockaddr
Browse files Browse the repository at this point in the history
The code uses ByteSliceFromString first, which
 - checks that the string does not contain \0;
 - copies the string to a byte slice which ends with \0.

Next, it does one more copy, to sa.raw fields.

Double copying is not needed because:
 - the code already checks that there's an extra byte for \0 in the
   sa.raw field;
 - there is no need to check for \0 byte in the middle of the fields
   (those are hash and cipher names, and an unknown name will result in
   EINVAL from the kernel).

While at it, remove the use of magic numbers.

Change-Id: I0cf096fad6f974507d4aa8d429f077000b3bb639
Reviewed-on: https://go-review.googlesource.com/c/sys/+/527836
TryBot-Result: Gopher Robot <[email protected]>
Auto-Submit: Ian Lance Taylor <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Run-TryBot: Kirill Kolyshkin <[email protected]>
Reviewed-by: Bryan Mills <[email protected]>
Reviewed-by: Tobias Klauser <[email protected]>
Reviewed-by: Ian Lance Taylor <[email protected]>
  • Loading branch information
kolyshkin authored and gopherbot committed Sep 15, 2023
1 parent c7cbcbb commit c7ff727
Showing 1 changed file with 4 additions and 13 deletions.
17 changes: 4 additions & 13 deletions unix/syscall_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -693,28 +693,19 @@ type SockaddrALG struct {

func (sa *SockaddrALG) sockaddr() (unsafe.Pointer, _Socklen, error) {
// Leave room for NUL byte terminator.
if len(sa.Type) > 13 {
if len(sa.Type) > len(sa.raw.Type)-1 {
return nil, 0, EINVAL
}
if len(sa.Name) > 63 {
if len(sa.Name) > len(sa.raw.Name)-1 {
return nil, 0, EINVAL
}

sa.raw.Family = AF_ALG
sa.raw.Feat = sa.Feature
sa.raw.Mask = sa.Mask

typ, err := ByteSliceFromString(sa.Type)
if err != nil {
return nil, 0, err
}
name, err := ByteSliceFromString(sa.Name)
if err != nil {
return nil, 0, err
}

copy(sa.raw.Type[:], typ)
copy(sa.raw.Name[:], name)
copy(sa.raw.Type[:], sa.Type)
copy(sa.raw.Name[:], sa.Name)

return unsafe.Pointer(&sa.raw), SizeofSockaddrALG, nil
}
Expand Down

0 comments on commit c7ff727

Please sign in to comment.