PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Fix crash in socket_bindtodevice: NULL device is permissible

Browse Source
This commit is contained in:
dmiller
2025-09-03 17:04:46 +00:00
parent cca10689fe
commit 5bb82a2ad0
2 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libnetutil/netutil.cc
View File

@@ -1120,7 +1120,9 @@ int netutil_raw_socket(const char *device) {
netutil_perror("setsockopt(SO_BROADCAST) failed"); netutil_perror("setsockopt(SO_BROADCAST) failed");
} }
sethdrinclude(rawsd); sethdrinclude(rawsd);
socket_bindtodevice(rawsd, device); if (device) {
socket_bindtodevice(rawsd, device);
}
return rawsd; return rawsd;
#endif #endif

28
nbase/nbase_misc.c
View File

@@ -266,20 +266,22 @@ int block_socket(int sd) {
int socket_bindtodevice(int sd, const char *device) { int socket_bindtodevice(int sd, const char *device) {
#ifdef SO_BINDTODEVICE #ifdef SO_BINDTODEVICE
char padded[sizeof(int)]; char padded[sizeof(int)];
size_t len; size_t len = 0;
len = strlen(device) + 1; if (device) {
/* In Linux 2.6.20 and earlier, there is a bug in SO_BINDTODEVICE that causes len = strlen(device) + 1;
EINVAL to be returned if the optlen < sizeof(int); this happens for example /* In Linux 2.6.20 and earlier, there is a bug in SO_BINDTODEVICE that causes
with the interface names "" and "lo". Pad the string with null characters EINVAL to be returned if the optlen < sizeof(int); this happens for example
so it is above this limit if necessary. with the interface names "" and "lo". Pad the string with null characters
http://article.gmane.org/gmane.linux.network/71887 so it is above this limit if necessary.
http://article.gmane.org/gmane.linux.network/72216 */ http://article.gmane.org/gmane.linux.network/71887
if (len < sizeof(padded)) { http://article.gmane.org/gmane.linux.network/72216 */
/* We rely on strncpy padding with nulls here. */ if (len < sizeof(padded)) {
strncpy(padded, device, sizeof(padded)); /* We rely on strncpy padding with nulls here. */
device = padded; strncpy(padded, device, sizeof(padded));
len = sizeof(padded); device = padded;
len = sizeof(padded);
}
} }
/* Linux-specific sockopt asking to use a specific interface. See socket(7). */ /* Linux-specific sockopt asking to use a specific interface. See socket(7). */