From 577cc512e4c2be2cfdff0f414f1c3081a414ac7f Mon Sep 17 00:00:00 2001
From: linuxdaemon
Date: Thu, 24 Jan 2019 10:55:50 -0600
Subject: Don't allow invalid characters in UNIX listener paths.

---
 src/socket.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'src/socket.cpp')

diff --git a/src/socket.cpp b/src/socket.cpp
index b33664f84..580d3ba49 100644
--- a/src/socket.cpp
+++ b/src/socket.cpp
@@ -107,6 +107,14 @@ int InspIRCd::BindPorts(FailedPortList& failed_ports)
 				continue;
 			}
 
+			// Check for characters which are problematic in the IRC message format.
+			if (path.find_first_of("\n\r\t!@: ") != std::string::npos)
+			{
+				this->Logs->Log("SOCKET", LOG_DEFAULT, "UNIX listener on %s at %s specified a path containing invalid characters!",
+					path.c_str(), tag->getTagLocation().c_str());
+				continue;
+			}
+
 			// Create the bindspec manually (aptosa doesn't work with AF_UNIX yet).
 			memset(&bindspec, 0, sizeof(bindspec));
 			bindspec.un.sun_family = AF_UNIX;
-- 
cgit v1.3.1-10-gc9f91


From 499121036c26a66a7b8b6195c8b837349f42df6c Mon Sep 17 00:00:00 2001
From: Peter Powell
Date: Thu, 7 Feb 2019 13:08:21 +0000
Subject: Add irc::sockets::untosa() for creating AF_UNIX sockaddrs.

Also fix an overly long albeit harmless memcpy when creating UNIX
socket listeners. Thanks to @psychon for reporting this.
---
 include/socket.h |  7 +++++++
 src/socket.cpp   | 19 +++++++++++++------
 2 files changed, 20 insertions(+), 6 deletions(-)

(limited to 'src/socket.cpp')

diff --git a/include/socket.h b/include/socket.h
index 47e89070f..e527bc7f5 100644
--- a/include/socket.h
+++ b/include/socket.h
@@ -120,6 +120,13 @@ namespace irc
 		 * @return true if the conversion was successful, false if not.
 		 */
 		CoreExport bool aptosa(const std::string& addr, int port, irc::sockets::sockaddrs& sa);
+
+		/** Convert a UNIX socket path to a binary sockaddr.
+		 * @param path The path to the UNIX socket.
+		 * @param sa The structure to place the result in. Will be zeroed prior to conversion.
+		 * @return True if the conversion was successful; otherwise, false.
+		 */
+		CoreExport bool untosa(const std::string& path, irc::sockets::sockaddrs& sa);
 	}
 }
 
diff --git a/src/socket.cpp b/src/socket.cpp
index 580d3ba49..759bc7272 100644
--- a/src/socket.cpp
+++ b/src/socket.cpp
@@ -100,7 +100,7 @@ int InspIRCd::BindPorts(FailedPortList& failed_ports)
 		{
 			// UNIX socket paths are length limited to less than PATH_MAX.
 			irc::sockets::sockaddrs bindspec;
-			if (path.length() > std::min(ServerInstance->Config->Limits.MaxHost, sizeof(bindspec.un.sun_path)))
+			if (path.length() > std::min(ServerInstance->Config->Limits.MaxHost, sizeof(bindspec.un.sun_path) - 1))
 			{
 				this->Logs->Log("SOCKET", LOG_DEFAULT, "UNIX listener on %s at %s specified a path that is too long!",
 					path.c_str(), tag->getTagLocation().c_str());
@@ -115,11 +115,7 @@ int InspIRCd::BindPorts(FailedPortList& failed_ports)
 				continue;
 			}
 
-			// Create the bindspec manually (aptosa doesn't work with AF_UNIX yet).
-			memset(&bindspec, 0, sizeof(bindspec));
-			bindspec.un.sun_family = AF_UNIX;
-			memcpy(&bindspec.un.sun_path, path.c_str(), sizeof(bindspec.un.sun_path));
-
+			irc::sockets::untosa(path, bindspec);
 			if (!BindPort(tag, bindspec, old_ports))
 				failed_ports.push_back(std::make_pair(bindspec, errno));
 			else
@@ -182,6 +178,17 @@ bool irc::sockets::aptosa(const std::string& addr, int port, irc::sockets::socka
 	return false;
 }
 
+bool irc::sockets::untosa(const std::string& path, irc::sockets::sockaddrs& sa)
+{
+	memset(&sa, 0, sizeof(sa));
+	if (path.length() >= sizeof(sa))
+		return false;
+
+	sa.un.sun_family = AF_UNIX;
+	memcpy(&sa.un.sun_path, path.c_str(), path.length() + 1);
+	return true;
+}
+
 int irc::sockets::sockaddrs::family() const
 {
 	return sa.sa_family;
-- 
cgit v1.3.1-10-gc9f91


From f37590259eeb5cb9634773c000ea8f0fa083683a Mon Sep 17 00:00:00 2001
From: Peter Powell
Date: Thu, 7 Feb 2019 17:35:44 +0000
Subject: Fix erroneously limiting to the size of sa instead of sun_path.

---
 src/socket.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/socket.cpp')

diff --git a/src/socket.cpp b/src/socket.cpp
index 759bc7272..abccd0408 100644
--- a/src/socket.cpp
+++ b/src/socket.cpp
@@ -181,7 +181,7 @@ bool irc::sockets::aptosa(const std::string& addr, int port, irc::sockets::socka
 bool irc::sockets::untosa(const std::string& path, irc::sockets::sockaddrs& sa)
 {
 	memset(&sa, 0, sizeof(sa));
-	if (path.length() >= sizeof(sa))
+	if (path.length() >= sizeof(sa.un.sun_path))
 		return false;
 
 	sa.un.sun_family = AF_UNIX;
-- 
cgit v1.3.1-10-gc9f91