Unbounded strcpy into sockaddr_un.sun_path in bsd_create_listen_socket_unix / bsd_create_connect_socket_unix (stack buffer overflow)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 65/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- c
- Domain
- networking, security
Research direction
Start in external/uWebSockets/uSockets/bsd.c at lines 570 and 755, and read how sockaddr_un.sun_path is defined and used in the surrounding socket setup. Check the platform path-length constraint and trace both inputs. Done means overlong paths no longer write past sun_path, with behavior validated for both listen and connect paths.
Written by the indexing model from the issue text.
Description
- Vulnerability Type: Buffer Overflow / Unsafe String Copy
- Location:
- external/uWebSockets/uSockets/bsd.c:570
- external/uWebSockets/uSockets/bsd.c:755
- Code:
- Line 570:
strcpy(server_address.sun_path, path); - Line 755:
strcpy(server_address.sun_path, server_path);
- Line 570:
- Explanation:
- The strcpy() function is used to copy a string into a fixed-size buffer (sun_path member of sockaddr_un structure, which is typically 108 bytes). If the input path or server_path exceeds this buffer size, it will overflow the stack, potentially allowing arbitrary code execution. This is a classic memory safety vulnerability.
- Dominant language
- C
- Stars
- 1.5k
- Forks
- 307
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from uNetworking/uSockets
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
uNetworking/uSockets#259 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
uNetworking/uSockets#258 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
uNetworking/uSockets#256 · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
uNetworking/uSockets#255 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
uNetworking/uSockets#250 ·
All issues in uNetworking/uSockets
Similar issues
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
hapostgres/pg_auto_failover#1190 ·
-
docs
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
P3 sonic-vpp
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sonic-net/sonic-buildimage#29662 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
spack/spack-packages#6586 ·