AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-25 14:30:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

setsourcefilter: Replace alloca with a scratch_buffer.

Browse Source 
Use a scratch_buffer rather than either alloca or malloc to reduce the
possibility of a stack overflow.

Suggested-by: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>
Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
This commit is contained in:
Joe Simmons-Talbott 2023-05-16 09:45:49 -04:00 committed by Siddhesh Poyarekar
parent 79b2667d1e
commit d9055634a3
1 changed files with 7 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
sysdeps/unix/sysv/linux/setsourcefilter.c
View File

@ -16,13 +16,10 @@
License along with the GNU C Library; if not, see
<https://www.gnu.org/licenses/>. */
#include <alloca.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <scratch_buffer.h>
#include "getsourcefilter.h"
@ -34,17 +31,12 @@ setsourcefilter (int s, uint32_t interface, const struct sockaddr *group,
/* We have to create an struct ip_msfilter object which we can pass
to the kernel. */
size_t needed = GROUP_FILTER_SIZE (numsrc);
int use_alloca = __libc_use_alloca (needed);
struct group_filter *gf;
if (use_alloca)
gf = (struct group_filter *) alloca (needed);
else
{
gf = (struct group_filter *) malloc (needed);
if (gf == NULL)
return -1;
}
struct scratch_buffer buf;
scratch_buffer_init (&buf);
if (!scratch_buffer_set_array_size (&buf, 1, needed))
return -1;
struct group_filter *gf = buf.data;
gf->gf_interface = interface;
memcpy (&gf->gf_group, group, grouplen);
@ -63,12 +55,7 @@ setsourcefilter (int s, uint32_t interface, const struct sockaddr *group,
else
result = __setsockopt (s, sol, MCAST_MSFILTER, gf, needed);
if (! use_alloca)
{
int save_errno = errno;
free (gf);
__set_errno (save_errno);
}
scratch_buffer_free (&buf);
return result;
}