From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antonio Quartulli Subject: [iproute2 2/2] ss: fix NULL pointer access when parsing unix sockets with oldformat Date: Sun, 7 Jan 2018 02:31:50 +0800 Message-ID: <20180106183150.10530-2-a@unstable.cc> References: <20180106183150.10530-1-a@unstable.cc> Cc: Antonio Quartulli , Stefano Brivio , Stephen Hemminger To: netdev@vger.kernel.org Return-path: Received: from s2.neomailbox.net ([5.148.176.60]:4547 "EHLO s2.neomailbox.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752231AbeAFTBC (ORCPT ); Sat, 6 Jan 2018 14:01:02 -0500 In-Reply-To: <20180106183150.10530-1-a@unstable.cc> Sender: netdev-owner@vger.kernel.org List-ID: When parsing and printing the unix sockets in unix_show(), if the oldformat is detected, the peer_name member of the sockstat object is left uninitialized (NULL). For this reason, if a filter has been specified on the command line, a strcmp() will crash when trying to access it. Avoid crash by checking that peer_name is not NULL before passing it to strcmp(). Cc: Stefano Brivio Cc: Stephen Hemminger Signed-off-by: Antonio Quartulli --- To crash ss, simply execute the following on a system using the old socket format: ss -x dst 192.168.1.1 or ss dst 192.168.1.1 (crash reproduced on linux-4.12.12) misc/ss.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/misc/ss.c b/misc/ss.c index b35859dc..29a25070 100644 --- a/misc/ss.c +++ b/misc/ss.c @@ -3711,7 +3711,10 @@ static int unix_show(struct filter *f) }; memcpy(st.local.data, &u->name, sizeof(u->name)); - if (strcmp(u->peer_name, "*")) + /* when parsing the old format rport is set to 0 and + * therefore peer_name remains NULL + */ + if (u->peer_name && strcmp(u->peer_name, "*")) memcpy(st.remote.data, &u->peer_name, sizeof(u->peer_name)); if (run_ssfilter(f->f, &st) == 0) { -- 2.15.1