From 6671ed57fbebd5bb5f48763ac21206a7a7297209 Mon Sep 17 00:00:00 2001 From: Sebastien Bacher Date: Fri, 23 Oct 2026 06:16:45 +0200 Subject: [PATCH] echosrv: fix undersized realloc in start_listen_sockets() sizeof(*sockfd) is the size of a pointer, not of struct listen_endpoint, so the second listen address overflows the buffer and corrupts the heap. This makes echosrv segfault on armhf and the test suite fail. --- echosrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/echosrv.c b/echosrv.c index 5029437..d8bc14b 100644 --- a/echosrv.c +++ b/echosrv.c @@ -318,7 +318,7 @@ int start_listen_sockets(struct listen_endpoint *sockfd[]) for (addr = start_addr; addr; addr = addr->ai_next) { num_addr++; - *sockfd = realloc(*sockfd, num_addr * sizeof(*sockfd)); + *sockfd = realloc(*sockfd, num_addr * sizeof(**sockfd)); (*sockfd)[num_addr-1].socketfd = listen_single_addr(addr, keepalive, udp); (*sockfd)[num_addr-1].type = udp ? SOCK_DGRAM : SOCK_STREAM; fprintf(stderr, "%d:\t%s\n", (*sockfd)[num_addr-1].socketfd, sprintaddr(buf, sizeof(buf), addr)); -- 2.43.0