FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-111178: Fix getsockaddrarg() undefined behavior by vstinner · Pull Request #131668 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

gh-111178: Fix getsockaddrarg() undefined behavior #131668

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vstinner merged 12 commits into from
Apr 1, 2025
+57 −14
Conversation 38 Commits 12 Checks 0 Files changed 2
Merged

gh-111178: Fix getsockaddrarg() undefined behavior #131668

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
88fc5c2
gh-111178: Fix getsockaddrarg() undefined behavior
vstinner Mar 24, 2025
1aebf4c
Simplify code
vstinner Mar 24, 2025
9eb932c
Initialize cid to 0
vstinner Mar 24, 2025
533a478
Use 'unsigned short' type
vstinner Mar 28, 2025
9968c1e
Use 'unsigned char'
vstinner Mar 28, 2025
a95b22d
Add NEWS entry
vstinner Mar 28, 2025
18ed09e
Use 'unsigned long' to parse channel on Windows
vstinner Mar 28, 2025
99dcf45
Fix BTPROTO_HCI on FreeBSD
vstinner Apr 1, 2025
c0d7d03
Update BTPROTO_HCI code
vstinner Apr 1, 2025
7178cfd
Change exception type to ValueError
vstinner Apr 1, 2025
94f7b6f
Remove outdated comments
vstinner Apr 1, 2025
7455bf5
Remove useless assignment
vstinner Apr 1, 2025
File filter

Filter by extension

Filter by extension .c  (1) .rst  (1) All 2 file types selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Library/2025-03-28-11-26-31.gh-issue-131668.tcS4xS.rst
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
:mod:`socket`: Fix code parsing AF_BLUETOOTH socket addresses.
70 changes: 56 additions & 14 deletions Modules/socketmodule.c
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -1521,11 +1521,15 @@ makesockaddr(SOCKET_T sockfd, struct sockaddr *addr, size_t addrlen, int proto)
struct sockaddr_hci *a = (struct sockaddr_hci *) addr;
#if defined(__NetBSD__) || defined(__DragonFly__)
return makebdaddr(&_BT_HCI_MEMB(a, bdaddr));
#else /* __NetBSD__ || __DragonFly__ */
#elif defined(__FreeBSD__)
char *node = _BT_HCI_MEMB(a, node);
size_t len = strnlen(node, sizeof(_BT_HCI_MEMB(a, node)));
return PyBytes_FromStringAndSize(node, (Py_ssize_t)len);
#else
PyObject *ret = NULL;
ret = Py_BuildValue("i", _BT_HCI_MEMB(a, dev));
return ret;
#endif /* !(__NetBSD__ || __DragonFly__) */
#endif
}

#if !defined(__FreeBSD__)
Expand Down Expand Up @@ -2044,15 +2048,21 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args,
struct sockaddr_l2 *addr = &addrbuf->bt_l2;
memset(addr, 0, sizeof(struct sockaddr_l2));
_BT_L2_MEMB(addr, family) = AF_BLUETOOTH;
_BT_L2_MEMB(addr, bdaddr_type) = BDADDR_BREDR;
if (!PyArg_ParseTuple(args, "si|iB", &straddr,
&_BT_L2_MEMB(addr, psm),
&_BT_L2_MEMB(addr, cid),
&_BT_L2_MEMB(addr, bdaddr_type))) {
unsigned short psm;
unsigned short cid = 0;
unsigned char bdaddr_type = BDADDR_BREDR;
if (!PyArg_ParseTuple(args, "sH|HB", &straddr,
&psm,
&cid,
&bdaddr_type)) {
PyErr_Format(PyExc_OSError,
"%s(): wrong format", caller);
return 0;
}
_BT_L2_MEMB(addr, psm) = psm;
_BT_L2_MEMB(addr, cid) = cid;
_BT_L2_MEMB(addr, bdaddr_type) = bdaddr_type;

if (setbdaddr(straddr, &_BT_L2_MEMB(addr, bdaddr)) < 0)
return 0;

Expand All @@ -2065,12 +2075,21 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args,
const char *straddr;
struct sockaddr_rc *addr = &addrbuf->bt_rc;
_BT_RC_MEMB(addr, family) = AF_BLUETOOTH;
if (!PyArg_ParseTuple(args, "si", &straddr,
&_BT_RC_MEMB(addr, channel))) {
PyErr_Format(PyExc_OSError,
"%s(): wrong format", caller);
#ifdef MS_WINDOWS
unsigned long channel;
# define FORMAT_CHANNEL "k"
#else
unsigned char channel;
# define FORMAT_CHANNEL "B"
#endif
if (!PyArg_ParseTuple(args, "s" FORMAT_CHANNEL,
&straddr, &channel)) {
PyErr_Format(PyExc_OSError, "%s(): wrong format", caller);
return 0;
}
#undef FORMAT_CHANNEL
_BT_RC_MEMB(addr, channel) = channel;

if (setbdaddr(straddr, &_BT_RC_MEMB(addr, bdaddr)) < 0)
return 0;

Expand All @@ -2092,14 +2111,37 @@ getsockaddrarg(PySocketSockObject *s, PyObject *args,
straddr = PyBytes_AS_STRING(args);
if (setbdaddr(straddr, &_BT_HCI_MEMB(addr, bdaddr)) < 0)
return 0;
#else /* __NetBSD__ || __DragonFly__ */
#elif defined(__FreeBSD__)
_BT_HCI_MEMB(addr, family) = AF_BLUETOOTH;
if (!PyBytes_Check(args)) {
PyErr_Format(PyExc_OSError, "%s: "
"wrong node format", caller);
return 0;
}
const char *straddr = PyBytes_AS_STRING(args);
size_t len = PyBytes_GET_SIZE(args);
if (strlen(straddr) != len) {
PyErr_Format(PyExc_ValueError, "%s: "
"node contains embedded null character", caller);
return 0;
}
if (len > sizeof(_BT_HCI_MEMB(addr, node))) {
PyErr_Format(PyExc_ValueError, "%s: "
"node too long", caller);
return 0;
}
strncpy(_BT_HCI_MEMB(addr, node), straddr,
sizeof(_BT_HCI_MEMB(addr, node)));
#else
_BT_HCI_MEMB(addr, family) = AF_BLUETOOTH;
if (!PyArg_ParseTuple(args, "i", &_BT_HCI_MEMB(addr, dev))) {
unsigned short dev = _BT_HCI_MEMB(addr, dev);

serhiy-storchaka Mar 29, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Where is it defined?

picnixz Apr 1, 2025 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

There's a bunch of define at the top of the file:

#if (defined(HAVE_BLUETOOTH_H) || defined(HAVE_BLUETOOTH_BLUETOOTH_H)) \
     && !defined(__NetBSD__) && !defined(__DragonFly__)
#define USE_BLUETOOTH 1
#if defined(__FreeBSD__)
...
#define _BT_HCI_MEMB(sa, memb) ((sa)->hci_##memb)
...
#elif defined(__NetBSD__) || defined(__DragonFly__) // <- unreachable
... 
#define _BT_HCI_MEMB(sa, memb) ((sa)->bt_##memb)
#else
...
#define _BT_HCI_MEMB(sa, memb) ((sa)->hci_##memb)
...
#endif
#endif

But AFAICT, the elif defined(__NetBSD__) || defined(__DragonFly__) is not possible at all since we're still in the big #if where we want !defined(__NetBSD__) && !defined(__DragonFly__). So indeed, it looks like the macro wouldn't be defined here.

I think we should remove !defined(__NetBSD__) && !defined(__DragonFly__)

serhiy-storchaka Apr 1, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

I know about _BT_HCI_MEMB. I asked on what platform the *_dev member is defined, what its name and the structure name. Its turned out that it is hci_node on FreeBSD and NetBSD. hci_dev should exist on Linux.
if (!PyArg_ParseTuple(args, "H", &dev)) {
PyErr_Format(PyExc_OSError,
"%s(): wrong format", caller);
return 0;
}
#endif /* !(__NetBSD__ || __DragonFly__) */
_BT_HCI_MEMB(addr, dev) = dev;
#endif
*len_ret = sizeof *addr;
return 1;
}
Expand Down
Back | FazBrowse Home | New Git URL