casaroli commented on code in PR #21418:
URL: https://github.com/apache/nuttx/pull/21418#discussion_r4478075631
##########
net/local/local_sockif.c:
##########
@@ -822,9 +863,73 @@ static int local_connect(FAR struct socket *psock,
#ifdef CONFIG_NET_LOCAL_DGRAM
case SOCK_DGRAM:
{
- /* Perform the datagram connection logic */
+ FAR struct local_conn_s *conn = psock->s_conn;
+ FAR const struct sockaddr_un *unaddr =
+ (FAR const struct sockaddr_un *)addr;
+
+ if (addr->sa_family == AF_UNSPEC)
+ {
+ memset(&conn->lc_daddr, 0, sizeof(conn->lc_daddr));
+ conn->lc_dconnected = false;
+ return OK;
+ }
- return -ENOSYS;
+ /* local_findconn() reads sun_path[0], so the caller must have
+ * supplied at least one byte of it.
+ */
+
+ if (addrlen < offsetof(struct sockaddr_un, sun_path) + 1)
Review Comment:
connect() to an empty name still returns 0. With addrlen 3 and sun_path[0]
== 0, or a full-size zeroed sockaddr_un, local_findconn() skips the NUL and
compares "" with lc_path, which matches any unbound socket, this one too. With
addrlen 3 it also reads sun_path[1] past the bytes the caller gave.
Fix: return -EINVAL when `addrlen <= sizeof(sa_family_t) + 1`, as
psock_local_bind() does, or when the name after the leading NUL is empty.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
