GNU bug report logs - #76907
Potential buffer overflow in getsockopt

Previous Next

To reply to this bug, email your comments to 76907 AT debbugs.gnu.org.
There is no need to reopen the bug first.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Mike Gran <spk121 <at> yahoo.com>
To: bug-guile <at> gnu.org
Subject: Potential buffer overflow in getsockopt
Date: Sun, 09 Mar 2025 17:56:52 -0700

[Message part 1 (text/plain, inline)]

struct timeval is a potential return value of struct getsockopt, but,
when HAVE_STRUCT_LINGER is not defined, scm_t_getsockopt_result may
be too small to hold a struct timeval.

To fix this, struct timeval can be added to the scm_t_getsockopt_result
union.

Regards,
Mike Gran

[0001-Fixes-potential-buffer-overflow-in-getsockopt.patch (text/x-patch, attachment)]

Message #8 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Mike Gran <spk121 <at> yahoo.com>
To: bug-guile <at> gnu.org
Subject: Re: Potential buffer overflow in getsockopt
Date: Mon, 10 Mar 2025 09:52:50 -0700

Mike Gran <spk121 <at> yahoo.com> writes:

> struct timeval is a potential return value of struct getsockopt, but,
> when HAVE_STRUCT_LINGER is not defined, scm_t_getsockopt_result may
> be too small to hold a struct timeval.
>
> To fix this, struct timeval can be added to the scm_t_getsockopt_result
> union.

Also, this should partially fix the guile-without-threads in Guix's
CI.

https://ci.guix.gnu.org/build/9530486/details

Regards,
Mike Gran

Message #13 received at 76907-done <at> debbugs.gnu.org (full text, mbox):

From: Rob Browning <rlb <at> defaultvalue.org>
To: Mike Gran <spk121 <at> yahoo.com>, 76907-done <at> debbugs.gnu.org
Subject: Re: bug#76907: Potential buffer overflow in getsockopt
Date: Tue, 18 Mar 2025 14:36:31 -0500

Mike Gran via "Bug reports for GUILE, GNU's Ubiquitous Extension
Language" <bug-guile <at> gnu.org> writes:

> struct timeval is a potential return value of struct getsockopt, but,
> when HAVE_STRUCT_LINGER is not defined, scm_t_getsockopt_result may
> be too small to hold a struct timeval.

Pushed to main along with a commit to add -Werror=array-bounds when
available which would have caught the issue.

Thanks
-- 
Rob Browning
rlb @defaultvalue.org and @debian.org
GPG as of 2011-07-10 E6A9 DA3C C9FD 1FF8 C676 D2C4 C0F0 39E9 ED1B 597A
GPG as of 2002-11-03 14DD 432F AE39 534D B592 F9A0 25C8 D377 8C7E 73A4

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.