Skip to content

fix(network): check buffer length before reading family in unpack_ip_port - #3073

Merged
Green-Sky merged 1 commit into
TokTok:masterfrom
NoxToxCipher:fix-unpack-nodes-bounds
Aug 25, 2026
Merged

fix(network): check buffer length before reading family in unpack_ip_port#3073
Green-Sky merged 1 commit into
TokTok:masterfrom
NoxToxCipher:fix-unpack-nodes-bounds

Conversation

@NoxToxCipher

@NoxToxCipher NoxToxCipher commented Aug 24, 2026

Copy link
Copy Markdown

In unpack_ip_port, data[0] was accessed without verifying that length > 0, causing a potential 1-byte out-of-bounds read on 0-length input. Additionally, checked ip_port and data before dereferencing.

In unpack_nodes, add an entry check verifying nodes is non-null when max_num_nodes > 0.

Added boundary unit tests in auto_tests/network_test.c covering zero-length inputs, truncated IPv4/IPv6 buffers, and invalid address families.


This change is Reviewable

@github-actions github-actions Bot added the bug Bug fix for the user, not a fix to a build script label Aug 24, 2026
@Green-Sky Green-Sky added this to the v0.2.24 milestone Aug 24, 2026
@Green-Sky

Copy link
Copy Markdown
Member

Thanks for the pr. We require commits to be signed by the author.


./auto_tests/network_test.c:168:43: error: null passed to a callee that requires a non-null argument [-Werror,-Wnonnull]
  168 |     ck_assert_int_eq(unpack_ip_port(&ipp, nullptr, 10, false), -1);
      |                                           ^~~~~~~
./auto_tests/network_test.c:175:37: error: null passed to a callee that requires a non-null argument [-Werror,-Wnonnull]
  175 |     ck_assert_int_eq(unpack_ip_port(nullptr, dummy_v4, sizeof(dummy_v4), false), -1);
      |                                     ^~~~~~~

I think it would be best to remove those test cases, we have static annotation for a reason.

@NoxToxCipher

Copy link
Copy Markdown
Author

Alright, on it. What do you think otherwise?

@NoxToxCipher
NoxToxCipher force-pushed the fix-unpack-nodes-bounds branch from dcd9696 to 03995e7 Compare August 24, 2026 14:41

@Green-Sky Green-Sky left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, the other change is fine but not changing anything.

Comment thread auto_tests/network_test.c
@Green-Sky

Copy link
Copy Markdown
Member

Also please add your signing public key to github, so it knows it is you :)

@codecov

codecov Bot commented Aug 24, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 69.79%. Comparing base (efb938b) to head (03995e7).
⚠️ Report is 1 commits behind head on master.

Files with missing lines Patch % Lines
toxcore/DHT.c 50.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #3073      +/-   ##
==========================================
- Coverage   69.82%   69.79%   -0.04%     
==========================================
  Files         185      185              
  Lines       34422    34424       +2     
==========================================
- Hits        24035    24025      -10     
- Misses      10387    10399      +12     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@NoxToxCipher
NoxToxCipher force-pushed the fix-unpack-nodes-bounds branch 2 times, most recently from cbe33fc to cd872c5 Compare August 24, 2026 19:01

@Green-Sky Green-Sky left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update op and commit message (usually they are supposed to be a match).

Then it should be ready.

…port

In unpack_ip_port, data[0] was accessed without verifying that length > 0, causing a potential 1-byte out-of-bounds read on 0-length input. Additionally, checked ip_port and data before dereferencing.

In unpack_nodes, add an entry check verifying nodes is non-null when max_num_nodes > 0.

Added boundary unit tests in auto_tests/network_test.c covering zero-length inputs, truncated IPv4/IPv6 buffers, and invalid address families.
@NoxToxCipher
NoxToxCipher force-pushed the fix-unpack-nodes-bounds branch from cd872c5 to 02daf25 Compare August 25, 2026 08:20
@NoxToxCipher NoxToxCipher changed the title fix(network): check buffer length and null pointers in unpack_ip_port fix(network): check buffer length before reading family in unpack_ip_port Aug 25, 2026

@Green-Sky Green-Sky left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good stuff

@Green-Sky
Green-Sky merged commit 02daf25 into TokTok:master Aug 25, 2026
82 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Bug fix for the user, not a fix to a build script

Development

Successfully merging this pull request may close these issues.

2 participants