{"action":"opened","issue":{"url":"https://api.github.com/repos/robbiehanson/CocoaAsyncSocket/issues/357","labels_url":"https://api.github.com/repos/robbiehanson/CocoaAsyncSocket/issues/357/labels{/name}","comments_url":"https://api.github.com/repos/robbiehanson/CocoaAsyncSocket/issues/357/comments","events_url":"https://api.github.com/repos/robbiehanson/CocoaAsyncSocket/issues/357/events","html_url":"https://github.com/robbiehanson/CocoaAsyncSocket/issues/357","id":109168409,"number":357,"title":"Buffer Overrun in getInterfaceAddressFromUrl","user":{"login":"swt2c","id":971544,"avatar_url":"https://avatars.githubusercontent.com/u/971544?v=3","gravatar_id":"","url":"https://api.github.com/users/swt2c","html_url":"https://github.com/swt2c","followers_url":"https://api.github.com/users/swt2c/followers","following_url":"https://api.github.com/users/swt2c/following{/other_user}","gists_url":"https://api.github.com/users/swt2c/gists{/gist_id}","starred_url":"https://api.github.com/users/swt2c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/swt2c/subscriptions","organizations_url":"https://api.github.com/users/swt2c/orgs","repos_url":"https://api.github.com/users/swt2c/repos","events_url":"https://api.github.com/users/swt2c/events{/privacy}","received_events_url":"https://api.github.com/users/swt2c/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-09-30T20:05:01Z","updated_at":"2015-09-30T20:05:01Z","closed_at":null,"body":"In the recently merged UNIX domain socket code, I've recently noticed that there's a potential buffer overrun in getInterfaceAddressFromUrl:\r\n\r\n    NSString *path = url.path;\r\n    if (path.length == 0) {\r\n        return nil;\r\n    }\r\n    \r\n    struct sockaddr_un nativeAddr;\r\n    nativeAddr.sun_family = AF_UNIX;\r\n    strcpy(nativeAddr.sun_path, path.fileSystemRepresentation);\r\n\r\nThe function calls strcpy() without checking the string length of path.fileSystemRepresentation.  If path has a rather long filename, this will overrun the char sun_path[104].\r\n\r\nAdditionally, I have been running into this file length limitation when using files in shared group containers, e.g., /Users/<user>/Library/Group Containers/<group>/<socketfile>.  Thus it would be helpful to support a filename longer than 104 characters.  Allocating a larger buffer and passing it to OSX seems to work fine."}}