mirror of
https://github.com/nmap/nmap.git
synced 2025-12-07 13:11:28 +00:00
Remove a bogus leftover use of a valid pointer as a throwaway variable
in getinterfaces. This was the cause of an overlapping memcpy reported at http://seclists.org/nmap-dev/2009/q2/0713.html. In the code, sin is a pointer that holds the address of the IP address configured for an interface. It is copied into a tmpifr.ifr_addr before each ioctl, perhaps because that is required on some platforms even though on Linux only ifr_name is needed by the ioctl. When the ioctl returns, it overwrites whatever was in ifr_addr because that member is in a union, so sin is kept in order to restore the address again before the next ioctl. In the code that handles SIOCGIFNETMASK, sin was mistakenly used as a temporary pointer and redirected to &tmpifr.ifr_addr. This caused all future memcpys before ioctl to copy tmpifr.ifr_addr to itself, rather than copying in the IP address of the interface. The throwaway sin assignment was not even used; the code that used it was modified in r2751. So now we just keep sin pointing where it should the whole time.
This commit is contained in:
3
tcpip.cc
3
tcpip.cc
@@ -2995,7 +2995,8 @@ static struct interface_info *getinterfaces_siocgifconf(int *howmany) {
|
||||
else if (rc < 0)
|
||||
mydevs[numifaces].netmask_bits = 32;
|
||||
else {
|
||||
sin = (struct sockaddr_in *) &(tmpifr.ifr_addr); /* ifr_netmask only on Linux */
|
||||
/* We would use ifr_netmask, but that's only on Linux, so use ifr_addr
|
||||
which shares the same memory space in a union. */
|
||||
addr_stob(&(tmpifr.ifr_addr), &mydevs[numifaces].netmask_bits);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user