Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
  • T Torsocks
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 38
    • Issues 38
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 0
    • Merge requests 0
  • Deployments
    • Deployments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • Repository
  • Activity
  • Graph
  • Create a new issue
  • Commits
  • Issue Boards
Collapse sidebar
  • The Tor Project
  • Core
  • Torsocks
  • Issues
  • #25627
Closed
Open
Issue created Mar 26, 2018 by Trac@tracbot

tsocks_gethostbyaddr_r scribbles garbage over data->hostname and then relies on it

Here's an edited version of the implementation with extraneous portions removed in an effort to make the mistake more clear:

        struct data {
                char *hostname;
                char *addr_list[2];
                char padding[];
        } *data;
        // ...
        data = (struct data *) buf;
        // ...
                ret_str = inet_ntop(type, addr, buf, buflen);
        // ...
        if (data->hostname) {

Specifically, notice that data is an alias for buf and therefore the underlying memory is given to inet_ntop to write on as a char* but then tsocks_gethostbyaddr_r tries to interpret that same memory through the data struct to retrieve the hostname field. The result is garbage which provokes a crash shortly afterwards:

        he->h_length = strlen(he->h_name);     

This case is triggered by an error response to the resolve_ptr request (\5\1\0\0) when the IP address is valid (so that inet_ntop writes the garbage to buf).

I can imagine a couple fixes. The simplest overall would seem to be to stack allocated a new buffer for inet_ntop. This makes calling tsocks_gethostbyaddr_r a little more expensive (in terms of stack space) but greatly simplifies the code be removing the surprising aliasing.

Trac:
Username: exarkun

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking