[PATCH iproute2 07/11] ss: fix rpcbind service cache

[Stephen Hemminger <stephen@networkplumber.org>]

init_service_resolver() left the name of an entry uninitialized
when the program was not in the rpc database, so ss -r could crash
using it. It also leaked an entry on every skipped mapping and
accepted a partly parsed address.

Parse the mapping before allocating, and name unknown programs by
number.

Reported-by: Anthropic OSS scanner (ANT-2026-M2GWD3L5)
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 misc/ss.c | 44 ++++++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c
index e0b26586..74cb3be1 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -1559,37 +1559,45 @@ static void init_service_resolver(void)
 		return;
 
 	for (; rhead; rhead = rhead->rpcb_next) {
-		char prog[128] = "rpc.";
+		const char *proto;
+		char prog[128];
 		struct scache *c;
-		int hport, lport, ok;
+		int hport, lport;
 
-		c = malloc(sizeof(*c));
-		if (!c)
+		if (sscanf(rhead->rpcb_map.r_addr, "::.%d.%d",
+			   &hport, &lport) != 2 &&
+		    sscanf(rhead->rpcb_map.r_addr, "0.0.0.0.%d.%d",
+			   &hport, &lport) != 2)
 			continue;
 
-		ok = sscanf(rhead->rpcb_map.r_addr, "::.%d.%d", &hport, &lport);
-		if (!ok)
-			ok = sscanf(rhead->rpcb_map.r_addr, "0.0.0.0.%d.%d",
-				    &hport, &lport);
-		if (!ok)
-			continue;
-		c->port = hport << 8 | lport;
-
 		if (strcmp(rhead->rpcb_map.r_netid, TCP_PROTO) == 0 ||
 		    strcmp(rhead->rpcb_map.r_netid, TCP6_PROTO) == 0)
-			c->proto = TCP_PROTO;
+			proto = TCP_PROTO;
 		else if (strcmp(rhead->rpcb_map.r_netid, UDP_PROTO) == 0 ||
 			 strcmp(rhead->rpcb_map.r_netid, UDP6_PROTO) == 0)
-			c->proto = UDP_PROTO;
+			proto = UDP_PROTO;
 		else if (strcmp(rhead->rpcb_map.r_netid, SCTP_PROTO) == 0)
-			c->proto = SCTP_PROTO;
+			proto = SCTP_PROTO;
 		else
 			continue;
 
 		rpc = getrpcbynumber(rhead->rpcb_map.r_prog);
-		if (rpc) {
-			strncat(prog, rpc->r_name, 128 - strlen(prog));
-			c->name = strdup(prog);
+		if (rpc)
+			snprintf(prog, sizeof(prog), "rpc.%s", rpc->r_name);
+		else
+			snprintf(prog, sizeof(prog), "rpc.%lu",
+				 (unsigned long)rhead->rpcb_map.r_prog);
+
+		c = malloc(sizeof(*c));
+		if (!c)
+			continue;
+
+		c->port = hport << 8 | lport;
+		c->proto = proto;
+		c->name = strdup(prog);
+		if (!c->name) {
+			free(c);
+			continue;
 		}
 
 		c->next = rlist;
-- 
2.53.0