[src/trunk]: src/sys/kern len argument to strlcpy() was incorrect when copying

[seanb <seanb%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/1627fbd6b651
branches:  trunk
changeset: 328404:1627fbd6b651
user:      seanb <seanb%NetBSD.org@localhost>
date:      Wed Apr 02 15:35:45 2014 +0000

description:
len argument to strlcpy() was incorrect when copying
out AF_LOCAL sockets in sysctl helper.  The entire
buffer wasn't available since sun_path member is not
at offset 0 in struct sockaddr_un.

diffstat:

 sys/kern/uipc_domain.c |  22 +++++++++++-----------
 1 files changed, 11 insertions(+), 11 deletions(-)

diffs (50 lines):

diff -r de946b98a767 -r 1627fbd6b651 sys/kern/uipc_domain.c
--- a/sys/kern/uipc_domain.c    Wed Apr 02 15:35:14 2014 +0000
+++ b/sys/kern/uipc_domain.c    Wed Apr 02 15:35:45 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: uipc_domain.c,v 1.90 2014/02/25 18:30:11 pooka Exp $   */
+/*     $NetBSD: uipc_domain.c,v 1.91 2014/04/02 15:35:45 seanb Exp $   */
 
 /*
  * Copyright (c) 1982, 1986, 1993
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_domain.c,v 1.90 2014/02/25 18:30:11 pooka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_domain.c,v 1.91 2014/04/02 15:35:45 seanb Exp $");
 
 #include <sys/param.h>
 #include <sys/socket.h>
@@ -424,10 +424,13 @@
         * endpoint.  bleah!
         */
        if (unp->unp_addr != NULL) {
-               un->sun_len = unp->unp_addr->sun_len;
-               un->sun_family = unp->unp_addr->sun_family;
-               strlcpy(un->sun_path, unp->unp_addr->sun_path,
-                   sizeof(pcb->ki_s));
+               /*
+                * We've added one to sun_len when allocating to
+                * hold terminating NUL which we want here.  See
+                * makeun().
+                */
+               memcpy(un, unp->unp_addr,
+                   min(sizeof(pcb->ki_s), unp->unp_addr->sun_len + 1));
        }
        else {
                un->sun_len = offsetof(struct sockaddr_un, sun_path);
@@ -436,11 +439,8 @@
        if (unp->unp_conn != NULL) {
                un = (struct sockaddr_un *)&pcb->ki_dst;
                if (unp->unp_conn->unp_addr != NULL) {
-                       un->sun_len = unp->unp_conn->unp_addr->sun_len;
-                       un->sun_family = unp->unp_conn->unp_addr->sun_family;
-                       un->sun_family = unp->unp_conn->unp_addr->sun_family;
-                       strlcpy(un->sun_path, unp->unp_conn->unp_addr->sun_path,
-                               sizeof(pcb->ki_d));
+                       memcpy(un, unp->unp_conn->unp_addr,
+                           min(sizeof(pcb->ki_s), unp->unp_conn->unp_addr->sun_len + 1));
                }
                else {
                        un->sun_len = offsetof(struct sockaddr_un, sun_path);