THRIFT-5930: c_glib: reject oversized Unix socket paths in thrift_server_socket_listen()

thrift_server_socket_listen() still copies the configured Unix socket path directly into a stack sockaddr_un and then binds it. The path comes from a GObject property and is not checked against sizeof(pin.sun_path) before the copy.\n\nReject Unix socket paths that do not fit in the local sockaddr_un.sun_path buffer before building the sockaddr and binding the socket.

Author: neosys007

lib/c_glib/src/thrift/c_glib/transport/thrift_server_socket.c

@@ -49,6 +49,28 @@ enum _ThriftServerSocketProperties
 
 G_DEFINE_TYPE(ThriftServerSocket, thrift_server_socket, THRIFT_TYPE_SERVER_TRANSPORT)
 
+static gboolean
+thrift_server_socket_path_fits_unix_addr (const gchar *path, GError **error)
+{
+  const size_t path_len = strlen (path);
+  const size_t sun_path_len = sizeof (((struct sockaddr_un *) 0)->sun_path);
+
+  if (path_len >= sun_path_len)
+  {
+    if (error != NULL)
+    {
+      g_set_error (error,
+                   THRIFT_SERVER_SOCKET_ERROR,
+                   THRIFT_SERVER_SOCKET_ERROR_BIND,
+                   "unix socket path is too long (%zu bytes, max %zu)",
+                   path_len, sun_path_len - 1);
+    }
+    return FALSE;
+  }
+
+  return TRUE;
+}
+
 gboolean
 thrift_server_socket_listen (ThriftServerTransport *transport, GError **error)
 {
@@ -80,6 +102,13 @@ thrift_server_socket_listen (ThriftServerTransport *transport, GError **error)
   /* bind to the socket */
   if (tsocket->path)
   {
+    if (!thrift_server_socket_path_fits_unix_addr (tsocket->path, error))
+    {
+      close (tsocket->sd);
+      tsocket->sd = THRIFT_INVALID_SOCKET;
+      return FALSE;
+    }
+
     /* create a socket structure */
     struct sockaddr_un pin;
     memset (&pin, 0, sizeof(pin));
@@ -374,4 +403,3 @@ thrift_server_socket_class_init (ThriftServerSocketClass *cls)
   tstc->accept = thrift_server_socket_accept;
   tstc->close = thrift_server_socket_close;
 }
-

lib/c_glib/test/testtransportsocket.c

@@ -18,6 +18,7 @@
  */
 
 #include <netdb.h>
+#include <sys/un.h>
 #include <sys/wait.h>
 
 #include <thrift/c_glib/transport/thrift_transport.h>
@@ -71,6 +72,18 @@ my_send(int socket, const void *buffer, size_t length, int flags)
 
 static void thrift_socket_server (const int port);
 static void thrift_socket_server_open (const int port, int times);
+
+static gchar *
+make_too_long_unix_socket_path (void)
+{
+  struct sockaddr_un addr;
+  const size_t path_len = sizeof (addr.sun_path) + 1;
+  gchar *path = g_malloc (path_len + 1);
+
+  memset (path, 'a', path_len);
+  path[path_len] = '\0';
+  return path;
+}
 /* test object creation and destruction */
 static void
 test_create_and_destroy(void)
@@ -288,6 +301,28 @@ test_peek(void)
   }
 }
 
+static void
+test_server_listen_rejects_too_long_unix_path (void)
+{
+  ThriftServerSocket *tsocket = NULL;
+  ThriftServerTransport *transport = NULL;
+  GError *error = NULL;
+  gchar *path = make_too_long_unix_socket_path ();
+
+  tsocket = g_object_new (THRIFT_TYPE_SERVER_SOCKET,
+                          "path", path,
+                          NULL);
+  transport = THRIFT_SERVER_TRANSPORT (tsocket);
+
+  g_assert (thrift_server_transport_listen (transport, &error) == FALSE);
+  g_assert_error (error, THRIFT_SERVER_SOCKET_ERROR, THRIFT_SERVER_SOCKET_ERROR_BIND);
+  g_clear_error (&error);
+  g_assert (tsocket->sd == THRIFT_INVALID_SOCKET);
+
+  g_object_unref (tsocket);
+  g_free (path);
+}
+
 static void
 thrift_socket_server_open (const int port, int times)
 {
@@ -355,7 +390,7 @@ main(int argc, char *argv[])
   g_test_add_func ("/testtransportsocket/OpenAndClose", test_open_and_close);
   g_test_add_func ("/testtransportsocket/ReadAndWrite", test_read_and_write);
   g_test_add_func ("/testtransportsocket/Peek", test_peek);
+  g_test_add_func ("/testtransportsocket/ServerListenRejectsTooLongUnixPath", test_server_listen_rejects_too_long_unix_path);
 
   return g_test_run ();
 }
-