SOCK: Fix buffer overreach when simplifying IPv4-mapped IPv6 addresses#521
Merged
pkoning2 merged 1 commit intoopen-simh:masterfrom May 2, 2026
Merged
SOCK: Fix buffer overreach when simplifying IPv4-mapped IPv6 addresses#521pkoning2 merged 1 commit intoopen-simh:masterfrom
pkoning2 merged 1 commit intoopen-simh:masterfrom
Conversation
pmetzger
added a commit
to pmetzger/zimh
that referenced
this pull request
Apr 28, 2026
This is a local implementation of the fix described by open-simh/simh PR 521, not a direct import of the upstream patch. Factor IPv4-mapped IPv6 address normalization into sim_sock_convert_ipv4_mapped_ipv6 and use the length of the source string after the skipped prefix. This prevents copying bytes after the terminating NUL when converting strings such as ::ffff:198.51.100.42 to bare IPv4 form. Add a unit test that places sentinel data after the original NUL and checks that conversion copies only through the terminator. Upstream-PR: open-simh/simh#521
|
Fixed in zimh in pmetzger/zimh@0a57aee ; SIMH might want to adopt the same fix as it is a little cleaner. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Indeed this is a bug.
The negative consequence is very low since it merely picks up some
7 bytes of data past the end of the NUL byte in the existing string which
is likely still within the calling routine's hostnamebuf buffer.
In any case, a slightly clearer fix would be
A similar IPv4-mapped to IPb6 address fixup also existed in sim_accept_conn_ex
with the correct length argument has been modified in the same way.