If recv_from_to is passed a buffer for the local endpoint address,

clobber it before doing anything else, just in case we can't retrieve
the address and the caller blindly uses the buffer anyways.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21747 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kadmin/server/network.c b/src/kadmin/server/network.c
index 14cfd46ad50f5802e6e6ba4a6f78e5d56336127c..8382b7350fc4b2dc69f0f2d3d166a586fc728621 100644 (file)
--- a/src/kadmin/server/network.c
+++ b/src/kadmin/server/network.c
@@ -1146,8 +1146,13 @@ recv_from_to(int s, void *buf, size_t len, int flags,
             struct sockaddr *to, socklen_t *tolen)
 {
 #if (!defined(IP_PKTINFO) && !defined(IPV6_PKTINFO)) || !defined(CMSG_SPACE)
-    if (to && tolen)
+    if (to && tolen) {
+       /* Clobber with something recognizeable in case we try to use
+          the address.  */
+       memset(to, 0x40, *tolen);
        *tolen = 0;
+    }
+
     return recvfrom(s, buf, len, flags, from, fromlen);
 #else
     int r;
@@ -1159,6 +1164,10 @@ recv_from_to(int s, void *buf, size_t len, int flags,
     if (!to || !tolen)
        return recvfrom(s, buf, len, flags, from, fromlen);
 
+    /* Clobber with something recognizeable in case we can't extract
+       the address but try to use it anyways.  */
+    memset(to, 0x40, *tolen);
+
     iov.iov_base = buf;
     iov.iov_len = len;
     memset(&msg, 0, sizeof(msg));

diff --git a/src/kdc/network.c b/src/kdc/network.c
index 56799522c638d51a31cad09aa760d80b9901c92e..fffaa1e788e10594a768b11917845c6cf1914bdb 100644 (file)
--- a/src/kdc/network.c
+++ b/src/kdc/network.c
@@ -1004,8 +1004,12 @@ recv_from_to(int s, void *buf, size_t len, int flags,
             struct sockaddr *to, socklen_t *tolen)
 {
 #if (!defined(IP_PKTINFO) && !defined(IPV6_PKTINFO)) || !defined(CMSG_SPACE)
-    if (to && tolen)
+    if (to && tolen) {
+       /* Clobber with something recognizeable in case we try to use
+          the address.  */
+       memset(to, 0x40, *tolen);
        *tolen = 0;
+    }
     return recvfrom(s, buf, len, flags, from, fromlen);
 #else
     int r;
@@ -1017,6 +1021,10 @@ recv_from_to(int s, void *buf, size_t len, int flags,
     if (!to || !tolen)
        return recvfrom(s, buf, len, flags, from, fromlen);
 
+    /* Clobber with something recognizeable in case we can't extract
+       the address but try to use it anyways.  */
+    memset(to, 0x40, *tolen);
+
     iov.iov_base = buf;
     iov.iov_len = len;
     memset(&msg, 0, sizeof(msg));