Extract the path from an AF_LOCAL sockaddr_un in a way that correctly

terminates the string in all cases, based on code from netstat(1).
The path in a sockaddr_un is terminated either by a '\0', or by
the end of the sockaddr as defined by sun_len.

Previously, the code could write the "safety" '\0' beyond the end
of the sockaddr (sockaddr_un's need only be large enough to store
sun_len bytes), and writing into the the supplied sockaddr is bad
anyway.

1 files changed, 5 insertions, 2 deletions

diff --git a/lib/libc/rpc/rpc_generic.c b/lib/libc/rpc/rpc_generic.c
index 81f0b6d..ad581a5 100644
--- a/lib/libc/rpc/rpc_generic.c
+++ b/lib/libc/rpc/rpc_generic.c
@@ -52,6 +52,7 @@
 #include <arpa/inet.h>
 #include <rpc/rpc.h>
 #include <ctype.h>
+#include <stddef.h>
 #include <stdio.h>
 #include <netdb.h>
 #include <netconfig.h>
@@ -621,8 +622,10 @@ __rpc_taddr2uaddr_af(int af, const struct netbuf *nbuf)
 #endif
 	case AF_LOCAL:
 		sun = nbuf->buf;
-		sun->sun_path[sizeof(sun->sun_path) - 1] = '\0'; /* safety */
-		ret = strdup(sun->sun_path);
+		if (asprintf(&ret, "%.*s", (int)(sun->sun_len -
+		    offsetof(struct sockaddr_un, sun_path)),
+		    sun->sun_path) < 0)
+			return (NULL);
 		break;
 	default:
 		return NULL;