Fix invalid write to static buffer in parse_addr_arg

This commit is contained in:
2026-02-26 00:11:34 +01:00
parent 5ff6a1e073
commit 0fbcbda4f7
5 changed files with 17 additions and 13 deletions
+12 -8
View File
@@ -184,27 +184,31 @@ bool addr_eql(Address a, Address b)
return true;
}
int parse_addr_arg(char *arg, Address *out)
int parse_addr_arg(string arg, Address *out)
{
int len = strlen(arg);
char buf[1<<7];
if (arg.len >= (int) sizeof(buf))
return -1;
memcpy(buf, arg.ptr, arg.len);
arg.ptr = buf;
int i = 0;
while (i < len && arg[i] != ':')
while (i < arg.len && arg.ptr[i] != ':')
i++;
if (i == len)
if (i == arg.len)
return -1; // No ':' character.
arg[i] = '\0';
arg.ptr[i] = '\0';
IPv4 ipv4;
int ret = inet_pton(AF_INET, arg, &ipv4);
arg[i] = ':';
int ret = inet_pton(AF_INET, arg.ptr, &ipv4);
arg.ptr[i] = ':';
if (ret != 1)
return -1;
errno = 0;
ret = atoi(arg + i + 1);
ret = atoi(arg.ptr + i + 1);
if (ret == 0 && errno != 0)
return -1;
+1 -1
View File
@@ -57,7 +57,7 @@ void append_hex_as_str(char *out, SHA256 hash);
bool addr_eql(Address a, Address b);
bool addr_lower(Address a, Address b);
int parse_addr_arg(char *arg, Address *out);
int parse_addr_arg(string arg, Address *out);
void addr_sort(Address *addrs, int count);
#endif // BASIC_INCLUDED
+1 -1
View File
@@ -140,7 +140,7 @@ ToastyFS *toastyfs_init(uint64_t client_id, char **addrs, int num_addrs)
tfs->request_id = 0;
for (int i = 0; i < num_addrs; i++) {
if (parse_addr_arg(addrs[i], &tfs->server_addrs[i]) < 0) {
if (parse_addr_arg((string) { addrs[i], strlen(addrs[i]) }, &tfs->server_addrs[i]) < 0) {
free(tfs);
return NULL;
}
+1 -1
View File
@@ -39,7 +39,7 @@ int http_proxy_init(void *state, int argc, char **argv,
// TODO: Make these configurable
int max_opers = 128;
char *http_addr = "127.0.0.1:3000";
string http_addr = S("127.0.0.1:3000");
uint64_t client_id = 999;
proxy->max_opers = max_opers;
+2 -2
View File
@@ -1317,7 +1317,7 @@ int server_init(void *state_, int argc, char **argv,
fprintf(stderr, "Option --addr missing value. Usage is --addr <addr>:<port>\n");
return -1;
}
int ret = parse_addr_arg(argv[i], &state->self_addr);
int ret = parse_addr_arg((string) { argv[i], strlen(argv[i]) }, &state->self_addr);
if (ret < 0) {
fprintf(stderr, "Malformed <addr>:<port> pair for --addr option\n");
return -1;
@@ -1337,7 +1337,7 @@ int server_init(void *state_, int argc, char **argv,
fprintf(stderr, "Node limit of %d reached\n", NODE_LIMIT);
return -1;
}
int ret = parse_addr_arg(argv[i], &state->node_addrs[state->num_nodes]);
int ret = parse_addr_arg((string) { argv[i], strlen(argv[i]) }, &state->node_addrs[state->num_nodes]);
if (ret < 0) {
fprintf(stderr, "Malformed <addr>:<port> pair for --peer option\n");
return -1;