github/n2n
4
0
Fork 0
mirror of https://github.com/ntop/n2n.git synced 2026-10-19 16:16:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: use snprintf to prevent stack buffer overflow in REGISTER_SUPER_ACK IPv6 handling (#1251)

Browse Source 
sprintf(ip_tmp, "%s:%u", ...) in the REGISTER_SUPER_ACK decoder can
overflow the 48-byte ip_tmp stack buffer when formatting an IPv6
address (up to 45 chars) with a port number, producing up to 52 bytes.

Replace sprintf with snprintf(ip_tmp, sizeof(ip_tmp), ...) so the
output is truncated to the buffer size.
This commit is contained in:
Tristan
2026-10-17 14:56:56 +02:00
committed by GitHub
parent fdd969b9c7
commit a6f94564f2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/edge_utils.c
+1 -1
View File
@@ -2559,7 +2559,7 @@ void process_udp (n2n_edge_t *eee, const struct sockaddr *sender_sock, const SOC
inet_ntop(payload_sock.family, inet_ntop(payload_sock.family,
(payload_sock.family == AF_INET) ? (void*)&(payload_sock.addr.v4) : (void*)&(payload_sock.addr.v6), (payload_sock.family == AF_INET) ? (void*)&(payload_sock.addr.v4) : (void*)&(payload_sock.addr.v6),
sn->ip_addr, N2N_EDGE_SN_HOST_SIZE - 1); sn->ip_addr, N2N_EDGE_SN_HOST_SIZE - 1);
sprintf(ip_tmp, "%s:%u", (char*)sn->ip_addr, (uint16_t)(payload_sock.port)); snprintf(ip_tmp, sizeof(ip_tmp), "%s:%u", (char*)sn->ip_addr, (uint16_t)(payload_sock.port));
memcpy(sn->ip_addr, ip_tmp, sizeof(ip_tmp)); memcpy(sn->ip_addr, ip_tmp, sizeof(ip_tmp));
} }
sn_selection_criterion_default(&(sn->selection_criterion)); sn_selection_criterion_default(&(sn->selection_criterion));