unix: fix double copy in (*SockaddrALG).sockaddr

The code uses ByteSliceFromString first, which
 - checks that the string does not contain \0;
 - copies the string to a byte slice which ends with \0.

Next, it does one more copy, to sa.raw fields.

Double copying is not needed because:
 - the code already checks that there's an extra byte for \0 in the
   sa.raw field;
 - there is no need to check for \0 byte in the middle of the fields
   (those are hash and cipher names, and an unknown name will result in
   EINVAL from the kernel).

While at it, remove the use of magic numbers.

Change-Id: I0cf096fad6f974507d4aa8d429f077000b3bb639
Reviewed-on: https://go-review.googlesource.com/c/sys/+/527836
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Ian Lance Taylor <iant@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Run-TryBot: Kirill Kolyshkin <kolyshkin@gmail.com>
Reviewed-by: Bryan Mills <bcmills@google.com>
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
This commit is contained in:
Kir Kolyshkin
2023-08-08 10:31:23 -07:00
committed by Gopher Robot
parent c7cbcbbfad
commit c7ff727a8c

View File

@@ -693,10 +693,10 @@ type SockaddrALG struct {
func (sa *SockaddrALG) sockaddr() (unsafe.Pointer, _Socklen, error) {
// Leave room for NUL byte terminator.
if len(sa.Type) > 13 {
if len(sa.Type) > len(sa.raw.Type)-1 {
return nil, 0, EINVAL
}
if len(sa.Name) > 63 {
if len(sa.Name) > len(sa.raw.Name)-1 {
return nil, 0, EINVAL
}
@@ -704,17 +704,8 @@ func (sa *SockaddrALG) sockaddr() (unsafe.Pointer, _Socklen, error) {
sa.raw.Feat = sa.Feature
sa.raw.Mask = sa.Mask
typ, err := ByteSliceFromString(sa.Type)
if err != nil {
return nil, 0, err
}
name, err := ByteSliceFromString(sa.Name)
if err != nil {
return nil, 0, err
}
copy(sa.raw.Type[:], typ)
copy(sa.raw.Name[:], name)
copy(sa.raw.Type[:], sa.Type)
copy(sa.raw.Name[:], sa.Name)
return unsafe.Pointer(&sa.raw), SizeofSockaddrALG, nil
}