uNetworking / uNetworking/uSockets
Unbounded strcpy into sockaddr_un.sun_path in bsd_create_listen_socket_unix / bsd_create_connect_socket_unix (stack buffer overflow)
Open
Beginner friendly
Nobody has claimed this yet.
enhancement
help wanted
- Dominant language
- C
- Stars
- 1.5k
- Forks
- 307
- PR merge metrics
- No merged PRs in 30d
Description
- Vulnerability Type: Buffer Overflow / Unsafe String Copy
- Location:
- external/uWebSockets/uSockets/bsd.c:570
- external/uWebSockets/uSockets/bsd.c:755
- Code:
- Line 570:
strcpy(server_address.sun_path, path); - Line 755:
strcpy(server_address.sun_path, server_path);
- Line 570:
- Explanation:
- The strcpy() function is used to copy a string into a fixed-size buffer (sun_path member of sockaddr_un structure, which is typically 108 bytes). If the input path or server_path exceeds this buffer size, it will overflow the stack, potentially allowing arbitrary code execution. This is a classic memory safety vulnerability.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in external/uWebSockets/uSockets/bsd.c at lines 570 and 755, and read how sockaddr_un.sun_path is defined and used in the surrounding socket setup. Check the platform path-length constraint and trace both inputs. Done means overlong paths no longer write past sun_path, with behavior validated for both listen and connect paths.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100