memory corruption in socket::recvfrom()

[ensc]

The addr field in

nix/src/sys/socket/mod.rs

Lines 1915 to 1924 in e5f354c

	let mut addr = mem::MaybeUninit::uninit();
	let mut len = mem::size_of::<T>() as socklen_t;
	let ret = Errno::result(libc::recvfrom(
	sockfd,
	buf.as_ptr() as *mut c_void,
	buf.len() as size_t,
	0,
	addr.as_mut_ptr() as *mut libc::sockaddr,
	&mut len as *mut socklen_t))? as usize;

is allocated only with a size of libc::sockaddr. This will overflow for most sockaddr types.

I suggest to write this as

diff --git a/src/sys/socket/mod.rs b/src/sys/socket/mod.rs
index 6386e62..59b274a 100644
--- a/src/sys/socket/mod.rs
+++ b/src/sys/socket/mod.rs
@@ -1912,7 +1912,7 @@ pub fn recvfrom<T:SockaddrLike>(sockfd: RawFd, buf: &mut [u8])
     -> Result<(usize, Option<T>)>
 {
     unsafe {
-        let mut addr = mem::MaybeUninit::uninit();
+        let mut addr = mem::MaybeUninit::<T>::uninit();
         let mut len = mem::size_of::<T>() as socklen_t;
 
         let ret = Errno::result(libc::recvfrom(
@@ -1923,7 +1923,7 @@ pub fn recvfrom<T:SockaddrLike>(sockfd: RawFd, buf: &mut [u8])
             addr.as_mut_ptr() as *mut libc::sockaddr,
             &mut len as *mut socklen_t))? as usize;
 
-        Ok((ret, T::from_raw(&addr.assume_init(), Some(len))))
+        Ok((ret, T::from_raw(addr.assume_init().as_ptr(), Some(len))))
     }
 }
 

[asomers]

Oh, good catch! I'll fix it shortly.