1From 0c8da1bead8ffaf270b4b723ead2c517371405d7 Mon Sep 17 00:00:00 2001
2From: Ariadne Conill <ariadne@dereferenced.org>
3Date: Sun, 3 Apr 2022 12:14:33 +0000
4Subject: [PATCH 1/2] libbb: sockaddr2str: ensure only printable characters are
5 returned for the hostname part
6
7CVE: CVE-2022-28391
8Upstream-Status: Pending
9Signed-off-by: Ariadne Conill <ariadne@dereferenced.org>
10Signed-off-by: Steve Sakoman <steve@sakoman.com>
11---
12 libbb/xconnect.c | 5 +++--
13 1 file changed, 3 insertions(+), 2 deletions(-)
14
15diff --git a/libbb/xconnect.c b/libbb/xconnect.c
16index 0e0b247b8..02c061e67 100644
17--- a/libbb/xconnect.c
18+++ b/libbb/xconnect.c
19@@ -497,8 +497,9 @@ static char* FAST_FUNC sockaddr2str(const struct sockaddr *sa, int flags)
20 	);
21 	if (rc)
22 		return NULL;
23+	/* ensure host contains only printable characters */
24 	if (flags & IGNORE_PORT)
25-		return xstrdup(host);
26+		return xstrdup(printable_string(host));
27 #if ENABLE_FEATURE_IPV6
28 	if (sa->sa_family == AF_INET6) {
29 		if (strchr(host, ':')) /* heh, it's not a resolved hostname */
30@@ -509,7 +510,7 @@ static char* FAST_FUNC sockaddr2str(const struct sockaddr *sa, int flags)
31 #endif
32 	/* For now we don't support anything else, so it has to be INET */
33 	/*if (sa->sa_family == AF_INET)*/
34-		return xasprintf("%s:%s", host, serv);
35+		return xasprintf("%s:%s", printable_string(host), serv);
36 	/*return xstrdup(host);*/
37 }
38
39--
402.35.1
41
42