From afa2167a4912246de7e756add1121e3d853f1c7f Mon Sep 17 00:00:00 2001 From: Alexia Ingerson Date: Wed, 8 Nov 2023 14:29:38 -0800 Subject: [PATCH] prov/sockets: fix possible buffer overrun when copying src addr ofi_sizeofip returns sizeof(struct in_addr) which can be 4 and ofi_sizeofaddr returns sizeof(struct ofi_sockaddr_in) which can be larger Use sizeofaddr instead of sizeofip to ensure we have enough space Signed-off-by: Alexia Ingerson --- prov/sockets/src/sock_ep.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/prov/sockets/src/sock_ep.c b/prov/sockets/src/sock_ep.c index c01c90b67a3..d3f6ad82335 100644 --- a/prov/sockets/src/sock_ep.c +++ b/prov/sockets/src/sock_ep.c @@ -1511,7 +1511,7 @@ struct fi_info *sock_fi_info(uint32_t version, enum fi_ep_type ep_type, info->src_addrlen = 0; info->dest_addrlen = 0; - info->src_addr = calloc(1, ofi_sizeofip(src_addr)); + info->src_addr = calloc(1, ofi_sizeofaddr(src_addr)); if (!info->src_addr) goto err; @@ -1532,7 +1532,7 @@ struct fi_info *sock_fi_info(uint32_t version, enum fi_ep_type ep_type, info->addr_format = FI_SOCKADDR_IN; if (dest_addr) { - info->dest_addr = calloc(1, ofi_sizeofip(dest_addr)); + info->dest_addr = calloc(1, ofi_sizeofaddr(dest_addr)); if (!info->dest_addr) goto err; info->dest_addrlen = ofi_sizeofaddr(dest_addr);