Skip to content

Commit c425de3

Browse files
author
Chandra Pratap
committed
common/wireaddr: Fix an out-of-bounds bug in the address parser
Changelog-Fixed: In `struct wireaddr`, the `addr` buffer is defined with a length of DNS_ADDRLEN (255). When parsing a valid DNS name that is exactly 255 bytes long, the subsequent attempt to append a `NULL` terminator overruns the buffer and triggers an out-of-bounds error under UBSan. Fix this by removing the line that appends `NULL`. This change is safe because the preceding call to: `memset(&addr->addr, 0, sizeof(addr->addr))` already zeroes the entire buffer.
1 parent ad2dc97 commit c425de3

File tree

1 file changed

+0
-1
lines changed

1 file changed

+0
-1
lines changed

common/wireaddr.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ bool fromwire_wireaddr(const u8 **cursor, size_t *max, struct wireaddr *addr)
4848
case ADDR_TYPE_DNS:
4949
addr->addrlen = fromwire_u8(cursor, max);
5050
memset(&addr->addr, 0, sizeof(addr->addr));
51-
addr->addr[addr->addrlen] = 0;
5251
break;
5352
default:
5453
return false;

0 commit comments

Comments
 (0)