Fix pre_mem_read_sockaddr crash on invalid syscall arguments. Bug #369356.

Don't do any more checks if it isn't safe to inspect the address family.
Likewise, don't check sun_path if the string address isn't safe.

Found by LTP testcases/kernel/syscalls/bind/bind01.

git-svn-id: svn://svn.valgrind.org/valgrind/trunk@15990

diff --git a/NEWS b/NEWS
index 67a0ecbb94e3260ccf678176709b790e6507b201..ae55de72f6cbb14bcf8531e19b54c314a7a47a84 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -180,6 +180,7 @@ where XXXXXX is the bug number as listed below.
 361253  [s390x] ex_clone.c:42: undefined reference to `pthread_create'
 369169  ppc64 fails jm_int_isa_2_07 test
 369209  valgrind loops and eats up all memory if cwd doesn't exist.
+369356  pre_mem_read_sockaddr syscall wrapper can crash with bad sockaddr
 
 n-i-bz Fix incorrect (or infinite loop) unwind on RHEL7 x86 and amd64
 n-i-bz massif --pages-as-heap=yes does not report peak caused by mmap+munmap

diff --git a/coregrind/m_syswrap/syswrap-generic.c b/coregrind/m_syswrap/syswrap-generic.c
index ed444943504ae364a9e50c087afc02ca8046544f..be887b1653b86abf8f484fbe16c2ac26636cf70a 100644 (file)
--- a/coregrind/m_syswrap/syswrap-generic.c
+++ b/coregrind/m_syswrap/syswrap-generic.c
@@ -1128,12 +1128,20 @@ void pre_mem_read_sockaddr ( ThreadId tid,
    VG_(sprintf) ( outmsg, description, "sa_family" );
    PRE_MEM_READ( outmsg, (Addr) &sa->sa_family, sizeof(vki_sa_family_t));
 
+   /* Don't do any extra checking if we cannot determine the sa_family. */
+   if (! ML_(safe_to_deref) (&sa->sa_family, sizeof(vki_sa_family_t))) {
+      VG_(free) (outmsg);
+      return;
+   }
+
    switch (sa->sa_family) {
                   
       case VKI_AF_UNIX:
-         VG_(sprintf) ( outmsg, description, "sun_path" );
-         PRE_MEM_RASCIIZ( outmsg, (Addr) saun->sun_path );
-         // GrP fixme max of sun_len-2? what about nul char?
+         if (ML_(safe_to_deref) (&saun->sun_path, sizeof (Addr))) {
+            VG_(sprintf) ( outmsg, description, "sun_path" );
+            PRE_MEM_RASCIIZ( outmsg, (Addr) saun->sun_path );
+            // GrP fixme max of sun_len-2? what about nul char?
+         }
          break;
                      
       case VKI_AF_INET: