akr	2013-04-17 20:01:17 +0900 (Wed, 17 Apr 2013)

  New Revision: 40335

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=40335

  Log:
    * ext/socket/rubysocket.h (SOCKLEN_MAX): Defined.
    
    * ext/socket/raddrinfo.c (ext/socket/raddrinfo.c): Reject too long
      Linux abstract socket name.

  Modified files:
    trunk/ChangeLog
    trunk/ext/socket/raddrinfo.c
    trunk/ext/socket/rubysocket.h

Index: ChangeLog
===================================================================
--- ChangeLog	(revision 40334)
+++ ChangeLog	(revision 40335)
@@ -1,3 +1,10 @@ https://github.com/ruby/ruby/blob/trunk/ChangeLog#L1
+Wed Apr 17 20:00:18 2013  Tanaka Akira  <akr@f...>
+
+	* ext/socket/rubysocket.h (SOCKLEN_MAX): Defined.
+
+	* ext/socket/raddrinfo.c (ext/socket/raddrinfo.c): Reject too long
+	  Linux abstract socket name.
+
 Wed Apr 17 19:45:27 2013  Aman Gupta  <tmm1@r...>
 
 	* iseq.c (iseq_location_setup): re-use existing string when iseq has
Index: ext/socket/rubysocket.h
===================================================================
--- ext/socket/rubysocket.h	(revision 40334)
+++ ext/socket/rubysocket.h	(revision 40335)
@@ -91,6 +91,12 @@ https://github.com/ruby/ruby/blob/trunk/ext/socket/rubysocket.h#L91
 #ifndef HAVE_TYPE_SOCKLEN_T
 typedef int socklen_t;
 #endif
+
+#define SOCKLEN_MAX \
+  (0 < (((socklen_t)0)-1) ? \
+   ~(socklen_t)0 : \
+   (((((socklen_t)1) << (sizeof(socklen_t) * CHAR_BIT - 2)) - 1) * 2 + 1))
+
 #ifndef RSTRING_SOCKLEN
 #  define RSTRING_SOCKLEN (socklen_t)RSTRING_LENINT
 #endif
Index: ext/socket/raddrinfo.c
===================================================================
--- ext/socket/raddrinfo.c	(revision 40334)
+++ ext/socket/raddrinfo.c	(revision 40335)
@@ -450,8 +450,10 @@ rsock_unix_sockaddr_len(VALUE path) https://github.com/ruby/ruby/blob/trunk/ext/socket/raddrinfo.c#L450
     }
     else if (RSTRING_PTR(path)[0] == '\0') {
 	/* abstract namespace; see unix(7) for details. */
+        if (SOCKLEN_MAX - offsetof(struct sockaddr_un, sun_path) < (size_t)RSTRING_LEN(path))
+            rb_raise(rb_eArgError, "Linux abstract socket too long");
 	return (socklen_t) offsetof(struct sockaddr_un, sun_path) +
-	    RSTRING_LEN(path);
+	    RSTRING_SOCKLEN(path);
     }
     else {
 #endif

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/