From 2eb6ad8578fa9d764c21a92acd8e054e3202ad19 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Mon, 10 Dec 2018 11:22:37 +0100 Subject: bpo-35050: AF_ALG length check off-by-one error (GH-10058) The length check for AF_ALG salg_name and salg_type had a off-by-one error. The code assumed that both values are not necessarily NULL terminated. However the Kernel code for alg_bind() ensures that the last byte of both strings are NULL terminated. Signed-off-by: Christian Heimes --- Lib/test/test_socket.py | 18 ++++++++++++++++++ .../2018-10-23-15-03-53.bpo-35050.49wraS.rst | 1 + Modules/socketmodule.c | 8 +++++--- 3 files changed, 24 insertions(+), 3 deletions(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2018-10-23-15-03-53.bpo-35050.49wraS.rst diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py index a2c047d..626a077 100644 --- a/Lib/test/test_socket.py +++ b/Lib/test/test_socket.py @@ -5969,6 +5969,24 @@ class LinuxKernelCryptoAPI(unittest.TestCase): with self.assertRaises(TypeError): sock.sendmsg_afalg(op=socket.ALG_OP_ENCRYPT, assoclen=-1) + def test_length_restriction(self): + # bpo-35050, off-by-one error in length check + sock = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0) + self.addCleanup(sock.close) + + # salg_type[14] + with self.assertRaises(FileNotFoundError): + sock.bind(("t" * 13, "name")) + with self.assertRaisesRegex(ValueError, "type too long"): + sock.bind(("t" * 14, "name")) + + # salg_name[64] + with self.assertRaises(FileNotFoundError): + sock.bind(("type", "n" * 63)) + with self.assertRaisesRegex(ValueError, "name too long"): + sock.bind(("type", "n" * 64)) + + @unittest.skipUnless(sys.platform.startswith("win"), "requires Windows") class TestMSWindowsTCPFlags(unittest.TestCase): knownTCPFlags = { diff --git a/Misc/NEWS.d/next/Core and Builtins/2018-10-23-15-03-53.bpo-35050.49wraS.rst b/Misc/NEWS.d/next/Core and Builtins/2018-10-23-15-03-53.bpo-35050.49wraS.rst new file mode 100644 index 0000000..9a33416 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2018-10-23-15-03-53.bpo-35050.49wraS.rst @@ -0,0 +1 @@ +:mod:`socket`: Fix off-by-one bug in length check for ``AF_ALG`` name and type. diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c index 04bfdaf..40f1ca6 100644 --- a/Modules/socketmodule.c +++ b/Modules/socketmodule.c @@ -2245,13 +2245,15 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args, { return 0; } - /* sockaddr_alg has fixed-sized char arrays for type and name */ - if (strlen(type) > sizeof(sa->salg_type)) { + /* sockaddr_alg has fixed-sized char arrays for type, and name + * both must be NULL terminated. + */ + if (strlen(type) >= sizeof(sa->salg_type)) { PyErr_SetString(PyExc_ValueError, "AF_ALG type too long."); return 0; } strncpy((char *)sa->salg_type, type, sizeof(sa->salg_type)); - if (strlen(name) > sizeof(sa->salg_name)) { + if (strlen(name) >= sizeof(sa->salg_name)) { PyErr_SetString(PyExc_ValueError, "AF_ALG name too long."); return 0; } -- cgit v0.12