fixes nanomsg#127 Bad format TCP address causes null pointer exception

I've added some tests to validate this too.
jeremiaskleer · Oct 23, 2017 · fdb73b6 · fdb73b6
1 parent d7fe2d3
commit fdb73b6
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 1 deletion.
diff --git a/src/transport/tcp/tcp.c b/src/transport/tcp/tcp.c
@@ -465,7 +465,7 @@ nni_tcp_parse_pair(char *pair, char **hostp, char **servp)
 	} else {
 		*hostp = host;
 	}
-	if (strlen(serv) == 0) {
+	if ((serv == NULL) || (strlen(serv) == 0)) {
 		*servp = NULL;
 	} else {
 		*servp = serv;

diff --git a/tests/tcp.c b/tests/tcp.c
@@ -81,5 +81,23 @@ TestMain("TCP Transport", {
 		So(nng_dial(s2, addr, NULL, 0) == 0);
 	});
 
+	Convey("Malformed TCP addresses do not panic", {
+		nng_socket s1;
+
+		So(nng_pair_open(&s1) == 0);
+		Reset({ nng_close(s1); });
+		So(nng_dial(s1, "tcp://127.0.0.1", NULL, 0) == NNG_EADDRINVAL);
+		So(nng_dial(s1, "tcp://127.0.0.1.32", NULL, 0) ==
+		    NNG_EADDRINVAL);
+		So(nng_dial(s1, "tcp://127.0.x.1.32", NULL, 0) ==
+		    NNG_EADDRINVAL);
+		So(nng_listen(s1, "tcp://127.0.0.1", NULL, 0) ==
+		    NNG_EADDRINVAL);
+		So(nng_listen(s1, "tcp://127.0.0.1.32", NULL, 0) ==
+		    NNG_EADDRINVAL);
+		So(nng_listen(s1, "tcp://127.0.x.1.32", NULL, 0) ==
+		    NNG_EADDRINVAL);
+	});
+
 	nng_fini();
 })
diff --git a/tests/tcp6.c b/tests/tcp6.c
@@ -69,6 +69,16 @@ check_props_v6(nng_msg *msg, nng_listener l, nng_dialer d)
 		So(nng_dialer_getopt(d, NNG_OPT_REMADDR, &ra, &z) != 0);
 	});
 
+	Convey("Malformed TCPv6 addresses do not panic", {
+		nng_socket s1;
+
+		So(nng_pair_open(&s1) == 0);
+		Reset({ nng_close(s1); });
+		So(nng_dial(s1, "tcp://::1", NULL, 0) == NNG_EADDRINVAL);
+		So(nng_dial(s1, "tcp://::1:5055", NULL, 0) == NNG_EADDRINVAL);
+		So(nng_dial(s1, "tcp://[::1]", NULL, 0) == NNG_EADDRINVAL);
+	});
+
 	return (0);
 }