diff options
| author | Sami Kerola <kerolasa@iki.fi> | 2019-03-23 14:33:07 +0000 |
|---|---|---|
| committer | Sami Kerola <kerolasa@iki.fi> | 2019-03-23 14:47:51 +0000 |
| commit | 9c581b7251a695bfc592443feff9a08a4df8d759 (patch) | |
| tree | 7573af49e5accbeac568c7497edc0c1f57531b39 | |
| parent | ef941daab94372410d79dc3950e7e7470563f713 (diff) | |
| download | iputils-9c581b7251a695bfc592443feff9a08a4df8d759.tar.gz | |
arping, ping: fix struct member access within null pointer
I noticed following print out while testing previous commit.
$ ping -N subject-ipv6=localhost ::1
ping6_common.c:343:12: runtime error: member access within null pointer
of type 'struct sockaddr_in6'
And the reasonable way to fix this issue is to use posix compliant
offsetof() macro. This issue has been part of ping since 0a33f3a865cfc7a
that added NI subject queries.
To my annoyance similar issue was also in arping, but the earlier commit
caused regression that is also fixed in this commit.
Reference: http://man7.org/linux/man-pages/man3/offsetof.3.html
Arping-regression: 0220aafbfa292c3c74437afa65aeeaebaeee9aa5
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
| -rw-r--r-- | arping.c | 3 | ||||
| -rw-r--r-- | ping6_common.c | 5 |
2 files changed, 4 insertions, 4 deletions
@@ -21,6 +21,7 @@ #include <net/if.h> #include <poll.h> #include <signal.h> +#include <stddef.h> #include <stdio.h> #include <stdlib.h> #include <string.h> @@ -108,7 +109,7 @@ static const cap_value_t caps[] = { CAP_NET_RAW }; __attribute__((const)) static inline size_t sll_len(const size_t halen) { const struct sockaddr_ll unused; - const size_t len = sizeof(unused.sll_addr) + halen; + const size_t len = offsetof(struct sockaddr_ll, sll_addr) + halen; if (len < sizeof(unused)) return sizeof(unused); diff --git a/ping6_common.c b/ping6_common.c index 1a76453..be6705d 100644 --- a/ping6_common.c +++ b/ping6_common.c @@ -319,7 +319,6 @@ static int niquery_set_subject_type(int type) } #define ARRAY_SIZE(array) (sizeof(array) / sizeof(array[0])) -#define OFFSET_OF(type,elem) ((size_t)&((type *)0)->elem) static int niquery_option_subject_addr_handler(int index, const char *arg) { @@ -340,12 +339,12 @@ static int niquery_option_subject_addr_handler(int index, const char *arg) switch (niquery_options[index].data) { case IPUTILS_NI_ICMP6_SUBJ_IPV6: ni_subject_len = sizeof(struct in6_addr); - offset = OFFSET_OF(struct sockaddr_in6, sin6_addr); + offset = offsetof(struct sockaddr_in6, sin6_addr); hints.ai_family = AF_INET6; break; case IPUTILS_NI_ICMP6_SUBJ_IPV4: ni_subject_len = sizeof(struct in_addr); - offset = OFFSET_OF(struct sockaddr_in, sin_addr); + offset = offsetof(struct sockaddr_in, sin_addr); hints.ai_family = AF_INET; break; default: |