PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 12:41:29 +00:00
Code Issues Projects Releases Wiki Activity

Fix crash in socket_bindtodevice: NULL device is permissible

Browse Source
This commit is contained in:
dmiller
2025-09-03 17:04:46 +00:00
parent cca10689fe
commit 5bb82a2ad0
2 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libnetutil/netutil.cc
View File

@@ -1120,7 +1120,9 @@ int netutil_raw_socket(const char *device) {
netutil_perror("setsockopt(SO_BROADCAST) failed");
}
sethdrinclude(rawsd);
socket_bindtodevice(rawsd, device);
if (device) {
socket_bindtodevice(rawsd, device);
}
return rawsd;
#endif

28
nbase/nbase_misc.c
View File

@@ -266,20 +266,22 @@ int block_socket(int sd) {
int socket_bindtodevice(int sd, const char *device) {
#ifdef SO_BINDTODEVICE
char padded[sizeof(int)];
size_t len;
size_t len = 0;
len = strlen(device) + 1;
/* In Linux 2.6.20 and earlier, there is a bug in SO_BINDTODEVICE that causes
EINVAL to be returned if the optlen < sizeof(int); this happens for example
with the interface names "" and "lo". Pad the string with null characters
so it is above this limit if necessary.
http://article.gmane.org/gmane.linux.network/71887
http://article.gmane.org/gmane.linux.network/72216 */
if (len < sizeof(padded)) {
/* We rely on strncpy padding with nulls here. */
strncpy(padded, device, sizeof(padded));
device = padded;
len = sizeof(padded);
if (device) {
len = strlen(device) + 1;
/* In Linux 2.6.20 and earlier, there is a bug in SO_BINDTODEVICE that causes
EINVAL to be returned if the optlen < sizeof(int); this happens for example
with the interface names "" and "lo". Pad the string with null characters
so it is above this limit if necessary.
http://article.gmane.org/gmane.linux.network/71887
http://article.gmane.org/gmane.linux.network/72216 */
if (len < sizeof(padded)) {
/* We rely on strncpy padding with nulls here. */
strncpy(padded, device, sizeof(padded));
device = padded;
len = sizeof(padded);
}
}
/* Linux-specific sockopt asking to use a specific interface. See socket(7). */