BUG/MEDIUM: server/event_hdl: memory overrun in _srv_event_hdl_prepare_inetaddr()

As reported in GH #2358, #2359, #2360, #2361 and #2362: ipv6 address
handling may cause memory overrun due to struct in6_addr being handled
as sockaddr_in6 which is larger. Moreover, source variable wasn't properly
read from since the raw value was used as a pointer instead of pointing to
the actual variable's address.

This bug was introduced by 6fde37e046
("MINOR: server/event_hdl: add SERVER_INETADDR event")

Unfortunately for us, gcc didn't catch this and, this actually used to
"work" by accident since in6_addr struct is made of array so not passing
pointer explicitly still resolved to the proper starting address..
Hopefully this was caught by coverity so thanks to Ilya for that.

The fix is simple: we simply copy the whole in6_addr struct by accessing
it using a pointer and using the proper struct size for the copy.

diff --git a/src/server.c b/src/server.c
index 8e12a3e33a50cba4678e85db2a7f0d8a5e665b5f..6eb34dcf54c7d9b6e5e583c87e80e89a6ce153d7 100644 (file)
--- a/src/server.c
+++ b/src/server.c
@@ -268,9 +268,9 @@ void _srv_event_hdl_prepare_inetaddr(struct event_hdl_cb_data_server_inetaddr *c
        }
        else {
                cb_data->safe.prev.family = AF_INET6;
-               memcpy(&cb_data->safe.prev.addr.v6.s6_addr,
-                      ((struct sockaddr_in6 *)prev_addr)->sin6_addr.s6_addr,
-                      sizeof(struct sockaddr_in6));
+               memcpy(&cb_data->safe.prev.addr.v6,
+                      &((struct sockaddr_in6 *)prev_addr)->sin6_addr,
+                      sizeof(struct in6_addr));
        }
        cb_data->safe.prev.svc_port = prev_port;
 
@@ -282,9 +282,9 @@ void _srv_event_hdl_prepare_inetaddr(struct event_hdl_cb_data_server_inetaddr *c
        }
        else {
                cb_data->safe.next.family = AF_INET6;
-               memcpy(&cb_data->safe.next.addr.v6.s6_addr,
-                      ((struct sockaddr_in6 *)next_addr)->sin6_addr.s6_addr,
-                      sizeof(struct sockaddr_in6));
+               memcpy(&cb_data->safe.next.addr.v6,
+                      &((struct sockaddr_in6 *)next_addr)->sin6_addr,
+                      sizeof(struct in6_addr));
        }
 
        cb_data->safe.next.svc_port = next_port;