[PATCH] avoid buffer overflow in sunrpc clnt_create (BZ #22542)

[Florian Weimer]

* Paul Eggert:

>>  struct sockaddr_un
>>    {
>>      __SOCKADDR_COMMON (sun_);
>> -    char sun_path[108];		/* Path name.  */
>> +    char sun_path[108]
>> +      __attribute_nonstring__;	/* Path name.  */
>>    };
>
> This says "sun_path uses strncpy format", but....
>
>> +      if (strlen (hostname) >= sizeof sun.sun_path)
>> +	{
>> +	  struct rpc_createerr *ce = &get_rpc_createerr ();
>> +	  ce->cf_stat = RPC_UNKNOWNHOST;
>> +	  ce->cf_error.re_errno = EINVAL;
>> +	  return NULL;
>> +	}
>
> ... this says "sun_path uses ordinary string format", which isn't consistent.
>
> I suggest that sun_path should use ordinary string format, since
> that's what people expect. In other words, do not add
> __attribute_nonstring__ or change clntunix_create, but instead just
> add the strlen check to clnt_create.

There is a definition of SUN_LEN in <sys/un.h> that uses strlen, not
strnlen:

/* Evaluate to actual length of the `sockaddr_un' structure.  */
# define SUN_LEN(ptr) ((size_t) (((struct sockaddr_un *) 0)->sun_path)        \
                      + strlen ((ptr)->sun_path))

The kernel adds its own terminator, after the user-specified struct
length, so it should be fine with a pathname that is 108 bytes long.

Thanks,
Florian