@xiaoge1001 Did you make sure you have the size for the out? You should make sure the output is large enough for ipv6, like struct sockaddr_storage or so.

@xiaoge1001 Did you make sure you have the size for the out? You should make sure the output is large enough for ipv6, like struct sockaddr_storage or so.

Hi, is this saying about the value of *outlen?

No, it's about the memcpy, check the manual of memcpy. Normally, struct sockaddr_storage should be enough.

struct sockaddr_storage {
	union {
		struct sockaddr ss_sa;
		struct sockaddr_in ss_sin;
		struct sockaddr_in6 ss_sin6;
		char ss_padding[128];
	} ss_union;
};

struct sockaddr *out;
struct sockaddr_in6 sin6;
... ....
memcpy(out, &sin6, sizeof(sin6));

Sorry, I don't understand how this is directly related to the struct sockaddr_storage structure.

I tested the 2.1.12 version and the latest version on GitHub, both have the problem. The gdb debugging result is as follows:

Breakpoint 1, evutil_parse_sockaddr_port (ip_as_string=<optimized out>, out=<optimized out>, outlen=<optimized out>) at /root/build-libevent/src/libevent/evutil.c:2383
2383    in /root/build-libevent/src/libevent/evutil.c
(gdb) p sizeof(out)
$4 = 8
(gdb) p sizeof(sin6)
$5 = 28
(gdb) p sizeof(*out)
$6 = 16
(gdb) ptype sin6
type = struct sockaddr_in6 {
    sa_family_t sin6_family;
    in_port_t sin6_port;
    uint32_t sin6_flowinfo;
    struct in6_addr sin6_addr;
    uint32_t sin6_scope_id;
}
(gdb) ptype out
type = struct sockaddr {
    sa_family_t sa_family;
    char sa_data[14];
} *
(gdb)

@xiaoge1001 Could you show a poc? How to reproduce.

		if ((int)sizeof(sin6) > *outlen)
			return -1;
                // ignore other codes
		memcpy(out, &sin6, sizeof(sin6));

As it never copy more data to out, so it's safe. However, if you cannot make sure out has outlen length, then there should be problem.

https://github.com/libevent/libevent/blob/master/evutil.c#L2379
I add the code:

printf("outlen is %d\n", *outlen);

out：
outlen is 2051025536

@xiaoge1001 Could you show a poc? How to reproduce.

		if ((int)sizeof(sin6) > *outlen)
			return -1;
                // ignore other codes
		memcpy(out, &sin6, sizeof(sin6));

As it never copy more data to out, so it's safe. However, if you cannot make sure out has outlen length, then there should be problem.

cat crash-sanitizer-145282c4e12d06cafbc46ffe6c9f0f25e19e34da23782953cd2ccc08a535f826
1::0000

@xiaoge1001 As I'm not familiar with crash-sanitizer or other ... cloud you change

		if ((int)sizeof(sin6) > *outlen)
			return -1;
		sin6.sin6_scope_id = if_index;
		memset(out, 0, *outlen);
		memcpy(out, &sin6, sizeof(sin6));

to

		if ((int)sizeof(sin6) > *outlen)
			return -1;
		sin6.sin6_scope_id = if_index;
		memset(out, 0, sizeof(sin6));
		memcpy(out, &sin6, sizeof(sin6));

or just remove the memset? And, actually, I don't believe out have size of 2051025536.

memset(out, 0, *outlen); change to memset(out, 0, sizeof(sin6));

the problem doesn't recur. Why is that?

@xiaoge1001 As I'm not familiar with crash-sanitizer or other ... cloud you change

		if ((int)sizeof(sin6) > *outlen)
			return -1;
		sin6.sin6_scope_id = if_index;
		memset(out, 0, *outlen);
		memcpy(out, &sin6, sizeof(sin6));

to

		if ((int)sizeof(sin6) > *outlen)
			return -1;
		sin6.sin6_scope_id = if_index;
		memset(out, 0, sizeof(sin6));
		memcpy(out, &sin6, sizeof(sin6));

or just remove the memset? And, actually, I don't believe out have size of 2051025536.

This is carefully constructed problematic input to test.

memset(out, 0, *outlen); change to memset(out, 0, sizeof(sin6));

the problem doesn't recur. Why is that?

As the outlen value is invalid, then memset with a large value, it will set all the memory to zero.
In your example, 2051025536 is about 2G, I think this would be large enough to make your system down.

However, I thinks it's a bug in your codes, not evutil_parse_sockaddr_port, libevent may choose to fix or not.

memset(out, 0, *outlen); change to memset(out, 0, sizeof(sin6));
the problem doesn't recur. Why is that?

As the outlen value is invalid, then memset with a large value, it will set all the memory to zero. In your example, 2051025536 is about 2G, I think this would be large enough to make your system down.

However, I thinks it's a bug in your codes, not evutil_parse_sockaddr_port, libevent may choose to fix or not.

Can we add a parameter check? For example:
a6c3d37

Can we add a parameter check? For example:

This looks like a hack, there is a check for outlen and it should be enough -

To catch other errors one could use sanitizers.

If you have some strong constructive objections, feel free to reopen.