PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 12:41:29 +00:00
Code Issues Projects Releases Wiki Activity

Fix crash in socket_bindtodevice: NULL device is permissible

Browse Source
This commit is contained in:
dmiller
2025-09-03 17:04:46 +00:00
parent cca10689fe
commit 5bb82a2ad0
2 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libnetutil/netutil.cc
View File

@@ -1120,7 +1120,9 @@ int netutil_raw_socket(const char *device) {
netutil_perror("setsockopt(SO_BROADCAST) failed"); netutil_perror("setsockopt(SO_BROADCAST) failed");
} }
sethdrinclude(rawsd); sethdrinclude(rawsd);
if (device) {
socket_bindtodevice(rawsd, device); socket_bindtodevice(rawsd, device);
}
return rawsd; return rawsd;
#endif #endif

4
nbase/nbase_misc.c
View File

@@ -266,8 +266,9 @@ int block_socket(int sd) {
int socket_bindtodevice(int sd, const char *device) { int socket_bindtodevice(int sd, const char *device) {
#ifdef SO_BINDTODEVICE #ifdef SO_BINDTODEVICE
char padded[sizeof(int)]; char padded[sizeof(int)];
size_t len; size_t len = 0;
if (device) {
len = strlen(device) + 1; len = strlen(device) + 1;
/* In Linux 2.6.20 and earlier, there is a bug in SO_BINDTODEVICE that causes /* In Linux 2.6.20 and earlier, there is a bug in SO_BINDTODEVICE that causes
EINVAL to be returned if the optlen < sizeof(int); this happens for example EINVAL to be returned if the optlen < sizeof(int); this happens for example
@@ -281,6 +282,7 @@ int socket_bindtodevice(int sd, const char *device) {
device = padded; device = padded;
len = sizeof(padded); len = sizeof(padded);
} }
}
/* Linux-specific sockopt asking to use a specific interface. See socket(7). */ /* Linux-specific sockopt asking to use a specific interface. See socket(7). */
if (setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, device, len) < 0) if (setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, device, len) < 0)