s4-lib/socket: Allocate a the larger sockaddr_un and not just a sockaddr_in in unixdo...
authorStefan Metzmacher <metze@samba.org>
Tue, 23 Jul 2013 22:19:26 +0000 (10:19 +1200)
committerAndrew Bartlett <abartlet@samba.org>
Wed, 24 Jul 2013 12:37:43 +0000 (14:37 +0200)
This caused crashes in _tsocket_address_bsd_from_sockaddr() when we
read past the end of the allocation.

(similar to commit e9ae36e9683372b86f1efbd29904722a33fea083)

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10042

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 24 14:37:43 CEST 2013 on sn-devel-104

source4/lib/socket/socket_unix.c

index 3aa5440242ffc90f9839eaf10912f622dbe043c8..6876e395ed632d1e706b865b33449b45460899e1 100644 (file)
@@ -362,7 +362,7 @@ static struct socket_address *unixdom_get_peer_addr(struct socket_context *sock,
 
 static struct socket_address *unixdom_get_my_addr(struct socket_context *sock, TALLOC_CTX *mem_ctx)
 {
-       struct sockaddr_in *local_addr;
+       struct sockaddr_un *local_addr;
        socklen_t len = sizeof(*local_addr);
        struct socket_address *local;
        int ret;
@@ -373,7 +373,7 @@ static struct socket_address *unixdom_get_my_addr(struct socket_context *sock, T
        }
        
        local->family = sock->backend_name;
-       local_addr = talloc(local, struct sockaddr_in);
+       local_addr = talloc(local, struct sockaddr_un);
        if (!local_addr) {
                talloc_free(local);
                return NULL;