Skip to content

Conversation

@markpizz
Copy link
Contributor

 There appears to be a bug in the "_sim_getaddrname" routine

within "sim_sock.c". This code appears:

if (0 == memcmp("::ffff:", hostnamebuf, 7))
memmove(hostnamebuf, 7+hostnamebuf,
strlen(hostnamebuf) + 7 - 1);

The intent is to slide the "hostnamebuf" string seven bytes to the
left to eliminate the "::ffff:" prefix. But it appears to move bytes
from beyond the end of "hostnamebuf".

I believe the last parameter should read "- 7 + 1" instead, as it does
in the earlier "memmove" call within "sim_accept_conn_ex".

Indeed this is a bug.

The negative consequence is very low since it merely picks up some
7 bytes of data past the end of the NUL byte in the existing string which
is likely still within the calling routine's hostnamebuf buffer.

In any case, a slightly clearer fix would be

           strlen(7+hostnamebuf) + 1);

A similar IPv4-mapped to IPb6 address fixup also existed in sim_accept_conn_ex
with the correct length argument has been modified in the same way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant