RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[BUG] str2sun could leak a small buffer in case of error during parsing 

Matt Farnsworth reported a memory leak in str2sun() in case a too large
socket path is passed. The bug is very minor because it only happens
once during config parsing, but has to be fixed nevertheless. The patch
Matt provided could even be improved by completely removing the useless
strdup() in this function.
This commit is contained in:
Willy Tarreau 2008-03-07 10:07:04 +01:00
parent f32d19a395
commit caf720d3ff
2 changed files with 5 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/common/standard.h
View File

@ -139,7 +139,7 @@ extern const char *invalid_char(const char *name);
* converts <str> to a struct sockaddr_un* which is locally allocated.
* The format is "/path", where "/path" is a path to a UNIX domain socket.
*/
struct sockaddr_un *str2sun(char *str);
struct sockaddr_un *str2sun(const char *str);
/*
* converts <str> to a struct sockaddr_in* which is locally allocated.

15
src/standard.c
View File

@ -83,27 +83,20 @@ const char *limit_r(unsigned long n, char *buffer, int size, const char *alt)
* converts <str> to a struct sockaddr_un* which is locally allocated.
* The format is "/path", where "/path" is a path to a UNIX domain socket.
*/
struct sockaddr_un *str2sun(char *str)
struct sockaddr_un *str2sun(const char *str)
{
static struct sockaddr_un su;
int strsz; /* length included null */
memset(&su, 0, sizeof(su));
str = strdup(str);
if (str == NULL)
goto out_nofree;
strsz = strlen(str) + 1;
if (strsz > sizeof(su.sun_path)) {
Alert("Socket path '%s' too long (max %d)\n",
str, sizeof(su.sun_path) - 1);
goto out_nofree;
} else {
su.sun_family = AF_UNIX;
memcpy(su.sun_path, str, strsz);
}
su.sun_family = AF_UNIX;
memcpy(su.sun_path, str, strsz);
free(str);
out_nofree:
return &su;
}