socket: Buffer overrun while reading unterminated AF_UNIX addresses

Open
#52,619 20 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
15/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
c, python

Research direction

The issue concerns CPython's socket extension, but no current source file is named; start by reviewing issue8372.patch and the listed Linux test programs bindconn.c and accept.c. Reproduce the unterminated AF_UNIX case on Linux, then run the relevant socket tests and confirm bounded address handling without a buffer overrun.

Written by the indexing model from the issue text.

Description

3.7 (EOL) extension-modules topic-socket type-security
BPO 8372
Nosy @loewis, @terryjreedy, @pitrou, @vstinner
Files
  • linux-pass-unterminated.diff: Allow non-null-terminated AF_UNIX addresses on Linux
  • return-unterminated-2.x.diff: Stop at end of address as given by addrlen (2.x)
  • return-unterminated-3.x.diff: Stop at end of address as given by addrlen (3.x)
  • addrlen-2.x.diff: Don't use addrlen larger than original buffer (2.x)
  • addrlen-3.x.diff: Don't use addrlen larger than original buffer (3.x)
  • test-2.x.diff: Tests for Linux (2.x)
  • test-3.x.diff: Tests for Linux (3.x)
  • bindconn.c: Test program to bind to an address and connect to a server
  • accept.c: Test program to accept connections and print the contents of sun_path
  • issue8372.patch
  • linux-pass-unterminated-4spc.diff
  • return-unterminated-2.x-4spc.diff
  • return-unterminated-3.x-4spc.diff
  • addrlen-2.x-4spc.diff
  • addrlen-3.x-4spc.diff
  • test-2.x-new.diff
  • test-3.x-new.diff
  • addrlen-makesockaddr-2.x.diff
  • addrlen-makesockaddr-3.x.diff
  • return-unterminated-2.x-new.diff
  • return-unterminated-3.x-maint-new.diff
  • return-unterminated-3.x-trunk-new.diff
  • enable-unterminated-2.7-2015-05-05.diff
  • fix-overrun-2.7-2015-05-05.diff
  • enable-unterminated-3.2-2015-05-05.diff
  • fix-overrun-3.2-2015-05-05.diff
  • enable-unterminated-3.3-2015-05-05.diff
  • fix-overrun-3.3-2015-05-05.diff
  • enable-unterminated-3.4-2015-05-05.diff
  • fix-overrun-3.4-2015-05-05.diff
  • enable-unterminated-3.5-2015-05-06.diff
  • fix-overrun-3.5-2015-05-06.diff
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = None
    created_at = <Date 2010-04-11.18:33:03.587>
    labels = ['type-security', 'extension-modules', '3.7']
    title = 'socket: Buffer overrun while reading unterminated AF_UNIX\taddresses'
    updated_at = <Date 2016-09-09.00:28:34.411>
    user = 'https://bugs.python.org/baikie'
    

    bugs.python.org fields:

    activity = <Date 2016-09-09.00:28:34.411>
    actor = 'BreamoreBoy'
    assignee = 'none'
    closed = False
    closed_date = None
    closer = None
    components = ['Extension Modules']
    creation = <Date 2010-04-11.18:33:03.587>
    creator = 'baikie'
    dependencies = []
    files = ['16874', '16875', '16876', '16877', '16878', '16879', '16880', '16898', '16899', '18753', '18770', '18771', '18772', '18773', '18774', '18775', '18776', '22384', '22385', '22386', '22387', '22388', '39297', '39298', '39299', '39300', '39301', '39302', '39303', '39304', '39309', '39310']
    hgrepos = []
    issue_num = 8372
    keywords = ['patch']
    message_count = 20.0
    messages = ['102861', '102964', '115595', '115606', '115615', '115669', '115673', '115716', '116112', '116178', '116226', '116234', '116236', '138213', '138214', '138224', '138472', '242577', '242621', '242695']
    nosy_count = 7.0
    nosy_names = ['loewis', 'terry.reedy', 'pitrou', 'vstinner', 'baikie', 'neologix', 'rosslagerwall']
    pr_nums = []
    priority = 'high'
    resolution = None
    stage = 'patch review'
    status = 'open'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue8372'
    versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6', 'Python 3.7']
    

    Dominant language
    Python
    Stars
    77.2k
    Forks
    36k
    Avg merge
    1d 9h
    Merged PRs (30d)
    558

    Contributor guide

    Open the contributing guide

    First steps

    1. Read the whole issue, then the project's contributing guide.
    2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
    3. Fork the repository and make your change on a branch.
    4. Open a pull request that references the issue number.

    More from python/cpython

    All issues in python/cpython

    Similar issues

    More Python issues

    Get new issues in your inbox

    A short digest of beginner-friendly GitHub issues.