From 4c3d1ca49d345f9301d0ea61ec427b2e0ee52ef6 Mon Sep 17 00:00:00 2001 From: Gerhard Rieger Date: Sun, 3 Oct 2010 15:46:10 +0200 Subject: [PATCH] fixed a bug where socat might crash when connecting to a unix domain socket using address GOPEN --- CHANGES | 5 +++++ VERSION | 2 +- test.sh | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++ xio-gopen.c | 4 ++-- 4 files changed, 67 insertions(+), 3 deletions(-) diff --git a/CHANGES b/CHANGES index 849aa1a..fc5e1d8 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,9 @@ +corrections: + fixed a bug where socat might crash when connecting to a unix domain + socket using address GOPEN. Thanks to Martin Forssen for bug report and + patch. + ####################### V 1.7.1.3: security: diff --git a/VERSION b/VERSION index 0537ddc..11171ac 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -"1.7.1.3" +"1.7.1.3+fixes" diff --git a/test.sh b/test.sh index 230d021..7ac6563 100755 --- a/test.sh +++ b/test.sh @@ -10241,6 +10241,65 @@ PORT=$((PORT+1)) N=$((N+1)) +# test for a bug in gopen that lead to crash or warning when opening a unix +# domain socket with GOPEN +NAME=GOPEN_UNIX_CRASH +case "$TESTS" in +*%functions%*|*%bugs%*|*%gopen%*|*%unix%*|*%socket%*|*%$NAME%*) +TEST="$NAME: check crash when connecting to a unix domain socket using address GOPEN" +# a unix domain server is started in background. the check process connects to +# its socket. when this process crashes or issues a warning the bug is present. +# please note that a clean behaviour does not proof anything; behaviour of bug +# depends on the value of an uninitialized var +#set -vx +if ! eval $NUMCOND; then :; else +tf="$td/test$N.stdout" +te="$td/test$N.stderr" +ts="$td/test$N.sock" +tdiff="$td/test$N.diff" +da="test$N $(date) $RANDOM" +CMD0="$SOCAT $opts UNIX-LISTEN:$ts PIPE" +CMD1="$SOCAT $opts -d - GOPEN:$ts" +printf "test $F_n $TEST... " $N +$CMD0 >/dev/null 2>"${te}0" "${tf}1" 2>"${te}1" +rc1=$? +kill $pid0 2>/dev/null; wait +if [ $rc1 -ne 0 ]; then + $PRINTF "$FAILED\n" + echo "$CMD0 &" + echo "$CMD1" + cat "${te}0" + cat "${te}1" + numFAIL=$((numFAIL+1)) +elif grep -q ' W ' "${te}1"; then + $PRINTF "$FAILED\n" + echo "$CMD0 &" + echo "$CMD1" + cat "${te}0" + cat "${te}1" + numFAIL=$((numFAIL+1)) +elif ! echo "$da" |diff - ${tf}1 >"$tdiff"; then + $PRINTF "$FAILED\n" + echo "$CMD0 &" + echo "$CMD1" + cat "${te}0" + cat "${te}1" + cat "$tdiff" + numFAIL=$((numFAIL+1)) +else + $PRINTF "$OK\n" + numOK=$((numOK+1)) +fi +fi # NUMCOND + ;; +esac +N=$((N+1)) +set +vx + + ############################################################################### # here come tests that might affect your systems integrity. Put normal tests # before this paragraph. diff --git a/xio-gopen.c b/xio-gopen.c index a30f61a..a4e2dec 100644 --- a/xio-gopen.c +++ b/xio-gopen.c @@ -1,5 +1,5 @@ /* source: xio-gopen.c */ -/* Copyright Gerhard Rieger 2001-2008 */ +/* Copyright Gerhard Rieger 2001-2010 */ /* Published under the GNU General Public License V.2, see file COPYING */ /* this file contains the source for opening addresses of generic open type */ @@ -46,7 +46,7 @@ static int xioopen_gopen(int argc, const char *argv[], struct opt *opts, int xio if (exists && S_ISSOCK(st_mode)) { #if WITH_UNIX union sockaddr_union us; - socklen_t uslen; + socklen_t uslen = sizeof(us); char infobuff[256]; Info1("\"%s\" is a socket, connecting to it", filename);