Source: sslh
Version: 2.1.4-1build2
Severity: normal
Tags: patch upstream
X-Debbugs-Cc: debian-arm@lists.debian.org, seb128@ubuntu.com
User: ubuntu-devel@lists.ubuntu.com
Usertags: origin-ubuntu tenacious ubuntu-patch
User: debian-arm@lists.debian.org
Usertags: armhf

Hi,

echosrv, the test helper, allocates its endpoint array with the size of a
pointer instead of the size of struct listen_endpoint (echosrv.c,
start_listen_sockets()):

  *sockfd = realloc(*sockfd, num_addr * sizeof(*sockfd));

When the listen address resolves to two addresses (localhost -> ::1 and
127.0.0.1), the second entry is written past the end of the buffer and
corrupts the heap.

The Debian builds pass by luck, but in Ubuntu this makes sslh fail to
build on armhf: every echosrv segfaults right after binding its first
address, and the ssh probe tests fail with "Connection refused":

  Listening to:
  3:	localhost:34089
  Segmentation fault
  ...
  not ok 3 - sslh-fork:ssh probe:probe
  not ok 4 - sslh-fork:ssh probe:shoveled

https://launchpad.net/ubuntu/+source/sslh/2.3.1-1build1/+build/33865533

The attached patch uses sizeof(**sockfd). With it, the armhf build has
no segfaults and all the tests pass. We are carrying it in Ubuntu as
2.3.1-1ubuntu1. It has also been sent upstream:

https://github.com/yrutschle/sslh/pull/559

Cheers,
Sebastien