bpo-35050: AF_ALG length check off-by-one error (GH-10058) (GH-11069)
The length check for AF_ALG salg_name and salg_type had a off-by-one
error. The code assumed that both values are not necessarily NULL
terminated. However the Kernel code for alg_bind() ensures that the last
byte of both strings are NULL terminated.
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 2eb6ad8578fa9d764c21a92acd8e054e3202ad19)
diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py
index db2160e..9b9d113 100644
--- a/Lib/test/test_socket.py
+++ b/Lib/test/test_socket.py
@@ -5944,6 +5944,24 @@
with self.assertRaises(TypeError):
sock.sendmsg_afalg(op=socket.ALG_OP_ENCRYPT, assoclen=-1)
+ def test_length_restriction(self):
+ # bpo-35050, off-by-one error in length check
+ sock = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)
+ self.addCleanup(sock.close)
+
+ # salg_type[14]
+ with self.assertRaises(FileNotFoundError):
+ sock.bind(("t" * 13, "name"))
+ with self.assertRaisesRegex(ValueError, "type too long"):
+ sock.bind(("t" * 14, "name"))
+
+ # salg_name[64]
+ with self.assertRaises(FileNotFoundError):
+ sock.bind(("type", "n" * 63))
+ with self.assertRaisesRegex(ValueError, "name too long"):
+ sock.bind(("type", "n" * 64))
+
+
@unittest.skipUnless(sys.platform.startswith("win"), "requires Windows")
class TestMSWindowsTCPFlags(unittest.TestCase):
knownTCPFlags = {