Bug#692433: /lib/x86_64-linux-gnu/ld-2.13.so: Re: getaddrinfo: Syscall param socketcall.connect(serv_addr.sin6_addr) points to uninitialised byte(s)
On Tue, Nov 13, 2012 at 06:05:37PM +0100, Alban Browaeys wrote:
> Package: libc6
> Version: 2.13-36
> Followup-For: Bug #692433
>
> Dear Maintainer,
> Attached is a patch for to fix:
> patches/kfreebsd/local-getaddrinfo-freebsd-kernel.diff
>
> The rationale:
> q->ai_addr is a pointer hack (it expands beyond sockaddr (q = p , p via
> gaih_inet(...end) - where end is a pointer to p, where end = pai =
> pointer to ai where ai->"ai_addrlen = socklen" change between ipv6 /
> ipv4 and "ai->ai_addr = (void *) (ai + 1);" pointer to the variable
> length addr matching socklen , 28 for ipv6). Thus struct sockaddr sa =
> q->ai_addr was likely a copy of sizeof (sa) ie 16 instead of
> q->ai_addr_len equal 28.
>
>
> Best regards
> Alban
>
> -- System Information:
> Debian Release: wheezy/sid
> APT prefers unstable
> APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental')
> Architecture: amd64 (x86_64)
> Foreign Architectures: i386
>
> Kernel: Linux 3.7.0-rc4test0-00020-g0e4a43e (SMP w/2 CPU cores)
> Locale: LANG=fr_FR.utf8, LC_CTYPE=fr_FR.utf8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
>
> Versions of packages libc6:amd64 depends on:
> ii libc-bin 2.13-36
> ii libgcc1 1:4.7.2-4
>
> libc6:amd64 recommends no packages.
>
> Versions of packages libc6:amd64 suggests:
> ii debconf [debconf-2.0] 1.5.46
> ii glibc-doc 2.13-36
> ii locales 2.13-36
> ii locales-all [locales] 2.13-36
>
> -- debconf information:
> * glibc/upgrade: true
> glibc/disable-screensaver:
> glibc/restart-failed:
> * glibc/restart-services: ssh saslauthd samba rsync openbsd-inetd mysql exim4 cups cron atd apache2
> libraries/restart-without-asking: false
> --- a/sysdeps/posix/getaddrinfo.c
> +++ b/sysdeps/posix/getaddrinfo.c
> @@ -2267,15 +2267,14 @@
> }
>
> socklen_t sl = sizeof (results[i].source_addr);
> - struct sockaddr sa = *q->ai_addr;
> #ifdef __FreeBSD_kernel__
> /* The FreeBSD kernel doesn't allow connections on port 0. Use
> port 1 instead, as on the FreeBSD libc. */
> - if (((struct sockaddr_in *)&sa)->sin_port == htons(0))
> - ((struct sockaddr_in *)&sa)->sin_port = htons(1);
> + if (((struct sockaddr_in *)q->ai_addr)->sin_port == htons(0))
> + ((struct sockaddr_in *)q->ai_addr)->sin_port = htons(1);
> #endif
> if (fd != -1
> - && __connect (fd, &sa, q->ai_addrlen) == 0
> + && __connect (fd, q->ai_addr, q->ai_addrlen) == 0
> && __getsockname (fd,
> (struct sockaddr *) &results[i].source_addr,
> &sl) == 0)
I don't think this patch is correct, as it returns struct addrinfo **res
with a port number different than the requested one (1 instead of 0).
Anyway I have committed a patch to fix that a few hours ago.
--
Aurelien Jarno GPG: 1024D/F1BCDB73
aurelien@aurel32.net http://www.aurel32.net
Reply to: