Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-12-08 06:10:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

bpo-45228: Fix stack buffer overflow in parsing J1939 address (GH-28404)

Browse source 
(cherry picked from commit 773319545b)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
This commit is contained in:
Miss Islington (bot) 2021-09-17 02:10:55 -07:00 • committed by GitHub
parent 7ad07eed88
commit 98fef200bb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Misc/NEWS.d/next/Library/2021-09-17-09-59-33.bpo-45228.WV1dcT.rst Normal file
View file

@ -0,0 +1 @@
Fix stack buffer overflow in parsing J1939 network address.

16
Modules/socketmodule.c
View file

@ -1555,10 +1555,10 @@ makesockaddr(SOCKET_T sockfd, struct sockaddr *addr, size_t addrlen, int proto)
#ifdef CAN_J1939 #ifdef CAN_J1939
case CAN_J1939: case CAN_J1939:
{ {
return Py_BuildValue("O&KkB", PyUnicode_DecodeFSDefault, return Py_BuildValue("O&KIB", PyUnicode_DecodeFSDefault,
ifname, ifname,
a->can_addr.j1939.name, (unsigned long long)a->can_addr.j1939.name,
a->can_addr.j1939.pgn, (unsigned int)a->can_addr.j1939.pgn,
a->can_addr.j1939.addr); a->can_addr.j1939.addr);
} }
#endif /* CAN_J1939 */ #endif /* CAN_J1939 */
@ -2249,13 +2249,13 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args,
PyObject *interfaceName; PyObject *interfaceName;
struct ifreq ifr; struct ifreq ifr;
Py_ssize_t len; Py_ssize_t len;
uint64_t j1939_name; unsigned long long j1939_name; /* at least 64 bits */
uint32_t j1939_pgn; unsigned int j1939_pgn; /* at least 32 bits */
uint8_t j1939_addr; uint8_t j1939_addr;
struct sockaddr_can *addr = &addrbuf->can; struct sockaddr_can *addr = &addrbuf->can;
if (!PyArg_ParseTuple(args, "O&KkB", PyUnicode_FSConverter, if (!PyArg_ParseTuple(args, "O&KIB", PyUnicode_FSConverter,
&interfaceName, &interfaceName,
&j1939_name, &j1939_name,
&j1939_pgn, &j1939_pgn,
@ -2283,8 +2283,8 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args,
addr->can_family = AF_CAN; addr->can_family = AF_CAN;
addr->can_ifindex = ifr.ifr_ifindex; addr->can_ifindex = ifr.ifr_ifindex;
addr->can_addr.j1939.name = j1939_name; addr->can_addr.j1939.name = (uint64_t)j1939_name;
addr->can_addr.j1939.pgn = j1939_pgn; addr->can_addr.j1939.pgn = (uint32_t)j1939_pgn;
addr->can_addr.j1939.addr = j1939_addr; addr->can_addr.j1939.addr = j1939_addr;
*len_ret = sizeof(*addr); *len_ret = sizeof(*addr);