akr	2009-01-13 01:00:03 +0900 (Tue, 13 Jan 2009)

  New Revision: 21469

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=21469

  Log:
    * ext/socket/socket.c (sock_s_unpack_sockaddr_in): check too short
      sockaddr.
      (sock_s_unpack_sockaddr_un): ditto.

  Modified files:
    branches/ruby_1_8/ChangeLog
    branches/ruby_1_8/ext/socket/socket.c
    branches/ruby_1_8/test/socket/test_socket.rb
    trunk/ChangeLog
    trunk/ext/socket/socket.c
    trunk/test/socket/test_socket.rb

Index: ChangeLog
===================================================================
--- ChangeLog	(revision 21468)
+++ ChangeLog	(revision 21469)
@@ -1,3 +1,9 @@
+Tue Jan 13 00:57:56 2009  Tanaka Akira  <akr@f...>
+
+	* ext/socket/socket.c (sock_s_unpack_sockaddr_in): check too short
+	  sockaddr.
+	  (sock_s_unpack_sockaddr_un): ditto.
+
 Mon Jan 12 23:55:19 2009  Tanaka Akira  <akr@f...>
 
 	* ext/socket/socket.c (addrinfo_ip_unpack): new method
Index: ext/socket/socket.c
===================================================================
--- ext/socket/socket.c	(revision 21468)
+++ ext/socket/socket.c	(revision 21469)
@@ -4328,6 +4328,11 @@
     VALUE host;
 
     sockaddr = (struct sockaddr_in*)SockAddrStringValuePtr(addr);
+    if (RSTRING_LEN(addr) <
+        (char*)&((struct sockaddr *)sockaddr)->sa_family +
+        sizeof(((struct sockaddr *)sockaddr)->sa_family) -
+        (char*)sockaddr)
+        rb_raise(rb_eArgError, "too short sockaddr");
     if (((struct sockaddr *)sockaddr)->sa_family != AF_INET
 #ifdef INET6
         && ((struct sockaddr *)sockaddr)->sa_family != AF_INET6
@@ -4397,6 +4402,11 @@
     VALUE path;
 
     sockaddr = (struct sockaddr_un*)SockAddrStringValuePtr(addr);
+    if (RSTRING_LEN(addr) <
+        (char*)&((struct sockaddr *)sockaddr)->sa_family +
+        sizeof(((struct sockaddr *)sockaddr)->sa_family) -
+        (char*)sockaddr)
+        rb_raise(rb_eArgError, "too short sockaddr");
     if (((struct sockaddr *)sockaddr)->sa_family != AF_UNIX) {
         rb_raise(rb_eArgError, "not an AF_UNIX sockaddr");
     }
Index: test/socket/test_socket.rb
===================================================================
--- test/socket/test_socket.rb	(revision 21468)
+++ test/socket/test_socket.rb	(revision 21469)
@@ -93,6 +93,8 @@
     assert_raise(ArgumentError) { Socket.unpack_sockaddr_un(sockaddr_in) }
     sockaddr_un = Socket.sockaddr_un("/tmp/s")
     assert_raise(ArgumentError) { Socket.unpack_sockaddr_in(sockaddr_un) }
+    assert_raise(ArgumentError) { Socket.unpack_sockaddr_in("") }
+    assert_raise(ArgumentError) { Socket.unpack_sockaddr_un("") }
   end if Socket.respond_to?(:sockaddr_un)
 
   def test_sysaccept
Index: ruby_1_8/ext/socket/socket.c
===================================================================
--- ruby_1_8/ext/socket/socket.c	(revision 21468)
+++ ruby_1_8/ext/socket/socket.c	(revision 21469)
@@ -3802,6 +3802,11 @@
     VALUE host;
 
     sockaddr = (struct sockaddr_in*)StringValuePtr(addr);
+    if (RSTRING_LEN(addr) < 
+        (char*)&((struct sockaddr *)sockaddr)->sa_family +
+        sizeof(((struct sockaddr *)sockaddr)->sa_family) -
+        (char*)sockaddr)
+        rb_raise(rb_eArgError, "too short sockaddr");
     if (((struct sockaddr *)sockaddr)->sa_family != AF_INET
 #ifdef INET6
         && ((struct sockaddr *)sockaddr)->sa_family != AF_INET6
@@ -3850,6 +3855,11 @@
     VALUE path;
 
     sockaddr = (struct sockaddr_un*)StringValuePtr(addr);
+    if (RSTRING_LEN(addr) < 
+        (char*)&((struct sockaddr *)sockaddr)->sa_family +
+        sizeof(((struct sockaddr *)sockaddr)->sa_family) -
+        (char*)sockaddr)
+        rb_raise(rb_eArgError, "too short sockaddr");
     if (((struct sockaddr *)sockaddr)->sa_family != AF_UNIX) {
         rb_raise(rb_eArgError, "not an AF_UNIX sockaddr");
     }
Index: ruby_1_8/ChangeLog
===================================================================
--- ruby_1_8/ChangeLog	(revision 21468)
+++ ruby_1_8/ChangeLog	(revision 21469)
@@ -1,3 +1,9 @@
+Tue Jan 13 00:57:56 2009  Tanaka Akira  <akr@f...>
+
+	* ext/socket/socket.c (sock_s_unpack_sockaddr_in): check too short
+	  sockaddr.
+	  (sock_s_unpack_sockaddr_un): ditto.
+
 Mon Jan 12 16:45:28 2009  Nobuyoshi Nakada  <nobu@r...>
 
 	* win32/win32.c (open_dir_handle): extracted from rb_w32_opendir.
Index: ruby_1_8/test/socket/test_socket.rb
===================================================================
--- ruby_1_8/test/socket/test_socket.rb	(revision 21468)
+++ ruby_1_8/test/socket/test_socket.rb	(revision 21469)
@@ -79,5 +79,7 @@
     assert_raise(ArgumentError) { Socket.unpack_sockaddr_un(sockaddr_in) }
     sockaddr_un = Socket.sockaddr_un("/tmp/s")
     assert_raise(ArgumentError) { Socket.unpack_sockaddr_in(sockaddr_un) }
+    assert_raise(ArgumentError) { Socket.unpack_sockaddr_in("") }
+    assert_raise(ArgumentError) { Socket.unpack_sockaddr_un("") }
   end
 end if defined?(Socket) && Socket.respond_to?(:sockaddr_un)

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/