NetworkBlockDevice / nbd

Network Block Device
GNU General Public License v2.0
450 stars 116 forks source link

Segfault in nbd-server.c due to calling freeaddrinfo on NULL #100

Closed Ikke closed 5 years ago

Ikke commented 5 years ago

In set_peername, when netaddr.ss_family == AF_UNIX, ai is never initialized.

On line 1733, freeaddrinfo is called unconditionally on ai, which might be NULL in some cases.

The musl implementation of getaddrinfo started to segfault when you pass it NULL. This caused some of the tests to fail on Alpine Linux, namely simple_test inetd and unix.

This patch was enough to fix the issue:

diff --git a/nbd-server.c b/nbd-server.c
index b0720ea140..cf3df0462a 100644
--- a/nbd-server.c
+++ b/nbd-server.c
@@ -1700,7 +1700,9 @@ int set_peername(int net, CLIENT *client) {
                        break;
        }

-       freeaddrinfo(ai);
+       if(ai) {
+               freeaddrinfo(ai);
+       }
         msg(LOG_INFO, "connect from %s, assigned file is %s",
             peername, client->exportname);
        client->clientname=g_strdup(peername);

Kind regards, Kevin

yoe commented 5 years ago

committed as 590ec9b41ff926232db71816ce4d845b68a21c1b

In future, please either send this to the mailinglist, or open a pull request. Copy/pasting patches from HTML emails is unnecessarily involved.