| Summary: | Example code in getifaddrs(3) man page can crash | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Daniel Berrangé <berrange> | |
| Component: | man-pages | Assignee: | Ivana Varekova <varekova> | |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 14 | CC: | varekova | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 683039 (view as bug list) | Environment: | ||
| Last Closed: | 2011-03-25 09:09:50 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
This problem is fixed in rawhide version |
Description of problem: In the getifaddrs(3) manual page, there is an 'EXAMPLE' section which contains code demonstrating how to use the getifaddrs() API. This code is not robust and will crash depending on the host OS network configuration # gcc -g -o if if.c # gdb ./if (gdb) run Starting program: /home/berrange/if lo address family: 17 (AF_PACKET) wlan0 address family: 17 (AF_PACKET) virbr0 address family: 17 (AF_PACKET) virbr0-nic address family: 17 (AF_PACKET) Program received signal SIGSEGV, Segmentation fault. 0x00000000004006f7 in main (argc=1, argv=0x7fffffffe1e8) at if.c:25 25 family = ifa->ifa_addr->sa_family; (gdb) print ifa->ifa_addr $1 = (struct sockaddr *) 0x0 (gdb) print *ifa $2 = {ifa_next = 0x602088, ifa_name = 0x602074 "tun0", ifa_flags = 69841, ifa_addr = 0x0, ifa_netmask = 0x0, ifa_ifu = {ifu_broadaddr = 0x0, ifu_dstaddr = 0x0}, ifa_data = 0x6027b8} This bit of the example code: /* Walk through linked list, maintaining head pointer so we can free list later */ for (ifa = ifaddr; ifa != NULL; ifa = ifa->ifa_next) { family = ifa->ifa_addr->sa_family; Should be changed to /* Walk through linked list, maintaining head pointer so we can free list later */ for (ifa = ifaddr; ifa != NULL; ifa = ifa->ifa_next) { family = ifa->ifa_addr ? ifa->ifa_addr->sa_family : AF_UNSPEC; ie, allow for ifa->ifa_addr being possibly NULL Version-Release number of selected component (if applicable): man-pages-3.25-1.fc14.noarch glibc-2.13-1.x86_64 How reproducible: Only if 'ifconfig -a' shows an interface with "Link encap:UNSPEC", eg tun0 from a VPNC connection Steps to Reproduce: 1. Start VPNC client 2. Run getifaddrs() example program 3. Actual results: $ ./if lo address family: 17 (AF_PACKET) wlan0 address family: 17 (AF_PACKET) virbr0 address family: 17 (AF_PACKET) virbr0-nic address family: 17 (AF_PACKET) Segmentation fault Expected results: $ ./if lo address family: 17 (AF_PACKET) wlan0 address family: 17 (AF_PACKET) virbr0 address family: 17 (AF_PACKET) virbr0-nic address family: 17 (AF_PACKET) tun0 address family: 0 eth0 address family: 17 (AF_PACKET) lo address family: 2 (AF_INET) address: <127.0.0.1> wlan0 address family: 2 (AF_INET) address: <192....> virbr0 address family: 2 (AF_INET) address: <192.....> tun0 address family: 2 (AF_INET) address: <10.....> lo address family: 10 (AF_INET6) address: <::1> wlan0 address family: 10 (AF_INET6) address: <2a01:....> wlan0 address family: 10 (AF_INET6) address: <fe80:....> Additional info: