Source: sslh Version: 2.1.4-1build2 Severity: normal Tags: patch upstream X-Debbugs-Cc: [email protected], [email protected] User: [email protected] Usertags: origin-ubuntu tenacious ubuntu-patch User: [email protected] Usertags: armhf
Hi, echosrv, the test helper, allocates its endpoint array with the size of a pointer instead of the size of struct listen_endpoint (echosrv.c, start_listen_sockets()): *sockfd = realloc(*sockfd, num_addr * sizeof(*sockfd)); When the listen address resolves to two addresses (localhost -> ::1 and 127.0.0.1), the second entry is written past the end of the buffer and corrupts the heap. The Debian builds pass by luck, but in Ubuntu this makes sslh fail to build on armhf: every echosrv segfaults right after binding its first address, and the ssh probe tests fail with "Connection refused": Listening to: 3: localhost:34089 Segmentation fault ... not ok 3 - sslh-fork:ssh probe:probe not ok 4 - sslh-fork:ssh probe:shoveled https://launchpad.net/ubuntu/+source/sslh/2.3.1-1build1/+build/33865533 The attached patch uses sizeof(**sockfd). With it, the armhf build has no segfaults and all the tests pass. We are carrying it in Ubuntu as 2.3.1-1ubuntu1. It has also been sent upstream: https://github.com/yrutschle/sslh/pull/559 Cheers, Sebastien -- System Information: Debian Release: forky/sid APT prefers resolute-updates APT policy: (500, 'resolute-updates'), (500, 'resolute-security'), (500, 'resolute'), (100, 'resolute-backports') Architecture: amd64 (x86_64) Kernel: Linux 7.0.0-38-generic (SMP w/16 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
fix-echosrv-realloc-size.patch
Description: application/mbox
