Fixed buffer overflow when retrieving socket addresses

swisspol · swisspol · commit aa8fc97b9b1a · 2015-07-03T10:17:33.000-07:00
diff --git a/GCDWebServer/Core/GCDWebServer.m b/GCDWebServer/Core/GCDWebServer.m
@@ -463,18 +463,18 @@ - (dispatch_source_t)_createDispatchSourceWithListeningSocket:(int)listeningSock
   dispatch_source_set_event_handler(source, ^{
     
     @autoreleasepool {
-      struct sockaddr remoteSockAddr;
+      struct sockaddr_storage remoteSockAddr;
       socklen_t remoteAddrLen = sizeof(remoteSockAddr);
-      int socket = accept(listeningSocket, &remoteSockAddr, &remoteAddrLen);
+      int socket = accept(listeningSocket, (struct sockaddr*)&remoteSockAddr, &remoteAddrLen);
       if (socket > 0) {
         NSData* remoteAddress = [NSData dataWithBytes:&remoteSockAddr length:remoteAddrLen];
         
-        struct sockaddr localSockAddr;
+        struct sockaddr_storage localSockAddr;
         socklen_t localAddrLen = sizeof(localSockAddr);
         NSData* localAddress = nil;
-        if (getsockname(socket, &localSockAddr, &localAddrLen) == 0) {
+        if (getsockname(socket, (struct sockaddr*)&localSockAddr, &localAddrLen) == 0) {
           localAddress = [NSData dataWithBytes:&localSockAddr length:localAddrLen];
-          GWS_DCHECK((!isIPv6 && localSockAddr.sa_family == AF_INET) || (isIPv6 && localSockAddr.sa_family == AF_INET6));
+          GWS_DCHECK((!isIPv6 && localSockAddr.ss_family == AF_INET) || (isIPv6 && localSockAddr.ss_family == AF_INET6));
         } else {
           GWS_DNOT_REACHED();
         }
@@ -511,11 +511,10 @@ - (BOOL)_start:(NSError**)error {
     return NO;
   }
   if (port == 0) {
-    struct sockaddr addr;
+    struct sockaddr_in addr;
     socklen_t addrlen = sizeof(addr);
-    if (getsockname(listeningSocket4, &addr, &addrlen) == 0) {
-      struct sockaddr_in* sockaddr = (struct sockaddr_in*)&addr;
-      port = ntohs(sockaddr->sin_port);
+    if (getsockname(listeningSocket4, (struct sockaddr*)&addr, &addrlen) == 0) {
+      port = ntohs(addr.sin_port);
     } else {
       GWS_LOG_ERROR(@"Failed retrieving socket address: %s (%i)", strerror(errno), errno);
     }
