Subject: bug#76907: closed (Re: bug#76907: Potential buffer overflow in getsockopt)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 18 Mar 2025 19:37:02 +0000

Your bug report

#76907: Potential buffer overflow in getsockopt

which was filed against the guile package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
76907: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=76907
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#76907: Potential buffer overflow in getsockopt
From: Rob Browning <[email-masked]>
To: Mike Gran <[email-masked]>, [email-masked]
Date: Tue, 18 Mar 2025 14:36:31 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

Mike Gran via "Bug reports for GUILE, GNU's Ubiquitous Extension
Language" <[email-masked]> writes:

> struct timeval is a potential return value of struct getsockopt, but,
> when HAVE_STRUCT_LINGER is not defined, scm_t_getsockopt_result may
> be too small to hold a struct timeval.

Pushed to main along with a commit to add -Werror=array-bounds when
available which would have caught the issue.

Thanks
-- 
Rob Browning
rlb @defaultvalue.org and @debian.org
GPG as of 2011-07-10 E6A9 DA3C C9FD 1FF8 C676 D2C4 C0F0 39E9 ED1B 597A
GPG as of 2002-11-03 14DD 432F AE39 534D B592 F9A0 25C8 D377 8C7E 73A4

Subject: Potential buffer overflow in getsockopt
From: Mike Gran <[email-masked]>
To: [email-masked]
Date: Sun, 09 Mar 2025 17:56:52 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

struct timeval is a potential return value of struct getsockopt, but,
when HAVE_STRUCT_LINGER is not defined, scm_t_getsockopt_result may
be too small to hold a struct timeval.

To fix this, struct timeval can be added to the scm_t_getsockopt_result
union.

Regards,
Mike Gran

>From 0ebd33ee05ad02aa9b96d9910c5facb087278d00 Mon Sep 17 00:00:00 2001
From: Michael Gran <[email-masked]>
Date: Sat, 8 Mar 2025 18:42:35 -0800
Subject: [PATCH] Fixes potential buffer overflow in getsockopt

struct timeval is a possible return value of getsockopt, but,
when HAVE_STRUCT_LINGER is not defined, scm_t_getsockopt_result
may be too small to hold a struct timeval.
* libguile/socket.c: add struct timeval to scm_t_getsockopt union
---
 libguile/socket.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libguile/socket.c b/libguile/socket.c
index 101afd80d..aa012c919 100644
--- a/libguile/socket.c
+++ b/libguile/socket.c
@@ -1,4 +1,4 @@
-/* Copyright 1996-1998,2000-2007,2009,2011-2015,2018,2021,2022
+/* Copyright 1996-1998,2000-2007,2009,2011-2015,2018,2021,2022,2025
      Free Software Foundation, Inc.
 
    This file is part of Guile.
@@ -454,6 +454,7 @@ typedef union
 #endif
   size_t size;
   int    integer;
+  struct timeval timeval;
 } scm_t_getsockopt_result;
 
 SCM_DEFINE (scm_getsockopt, "getsockopt", 3, 0, 0,
-- 
2.48.1