From 34724e6988909925059c1658b22a0dbe2ed7f324 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= Date: Sat, 24 Jan 2026 23:11:41 +0100 Subject: [PATCH] libredirect: abort if rewritten UNIX socket path is too long Use snprintf instead of strncpy to make it easier/more efficient to detect truncation. abort() (and nothing else) is already used for error handling in rewrite(), so use that here too, in bind() and connect(). --- pkgs/by-name/li/libredirect/libredirect.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/li/libredirect/libredirect.c b/pkgs/by-name/li/libredirect/libredirect.c index f700547c307c..c1a6720692ec 100644 --- a/pkgs/by-name/li/libredirect/libredirect.c +++ b/pkgs/by-name/li/libredirect/libredirect.c @@ -120,8 +120,10 @@ WRAPPER(int, bind)(int socket, const struct sockaddr *addr, socklen_t addr_len) struct sockaddr_un real_addr_un = *(struct sockaddr_un *)addr; const char *sun_path = rewrite(real_addr_un.sun_path, buf); if (sun_path != real_addr_un.sun_path) { - strncpy(real_addr_un.sun_path, buf, sizeof(real_addr_un.sun_path) - 1); - real_addr_un.sun_path[sizeof(real_addr_un.sun_path) - 1] = '\0'; + int n = snprintf(real_addr_un.sun_path, sizeof(real_addr_un.sun_path), "%s", buf); + if (n < 0 || n >= sizeof(real_addr_un.sun_path)) { + abort(); + } real_addr = (struct sockaddr *)&real_addr_un; addr_len = offsetof(struct sockaddr_un, sun_path) + strlen(real_addr_un.sun_path) + 1; } @@ -139,8 +141,10 @@ WRAPPER(int, connect)(int socket, const struct sockaddr *addr, socklen_t addr_le struct sockaddr_un real_addr_un = *(struct sockaddr_un *)addr; const char *sun_path = rewrite(real_addr_un.sun_path, buf); if (sun_path != real_addr_un.sun_path) { - strncpy(real_addr_un.sun_path, buf, sizeof(real_addr_un.sun_path) - 1); - real_addr_un.sun_path[sizeof(real_addr_un.sun_path) - 1] = '\0'; + int n = snprintf(real_addr_un.sun_path, sizeof(real_addr_un.sun_path), "%s", buf); + if (n < 0 || n >= sizeof(real_addr_un.sun_path)) { + abort(); + } real_addr = (struct sockaddr *)&real_addr_un; addr_len = offsetof(struct sockaddr_un, sun_path) + strlen(real_addr_un.sun_path) + 1; }