ape: check *alen before copying in getpeername(), getsockname() and accept()

*alen has to be initialized to the size of the buffer
by the caller, and we are supposed to put the real
size of the address in there, but not copy more than
the original *alen value (truncate).

1 files changed, 6 insertions, 0 deletions

diff --git a/sys/src/ape/lib/bsd/bind.c b/sys/src/ape/lib/bsd/bind.c
index 902fbcd46..a4c7ae573 100644
--- a/sys/src/ape/lib/bsd/bind.c
+++ b/sys/src/ape/lib/bsd/bind.c
@@ -25,6 +25,7 @@ int
 bind(int fd, void *a, int alen)
 {
 	int n, len, cfd, port;
+	struct sockaddr *sa;
 	Rock *r;
 	char msg[128];
 
@@ -34,6 +35,11 @@ bind(int fd, void *a, int alen)
 		errno = ENOTSOCK;
 		return -1;
 	}
+	sa = (struct sockaddr*)a;
+	if(sa->sa_family != r->domain){
+		errno = EAFNOSUPPORT;
+		return -1;
+	}
 	if(alen > sizeof(r->addr)){
 		errno = ENAMETOOLONG;
 		return -1;