init_service_resolver() left the name of an entry uninitialized when the program was not in the rpc database, so ss -r could crash using it. It also leaked an entry on every skipped mapping and accepted a partly parsed address. Parse the mapping before allocating, and name unknown programs by number. Reported-by: Anthropic OSS scanner (ANT-2026-M2GWD3L5) Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Stephen Hemminger --- misc/ss.c | 44 ++++++++++++++++++++++++++------------------ 1 file changed, 26 insertions(+), 18 deletions(-) diff --git a/misc/ss.c b/misc/ss.c index e0b26586..74cb3be1 100644 --- a/misc/ss.c +++ b/misc/ss.c @@ -1559,37 +1559,45 @@ static void init_service_resolver(void) return; for (; rhead; rhead = rhead->rpcb_next) { - char prog[128] = "rpc."; + const char *proto; + char prog[128]; struct scache *c; - int hport, lport, ok; + int hport, lport; - c = malloc(sizeof(*c)); - if (!c) + if (sscanf(rhead->rpcb_map.r_addr, "::.%d.%d", + &hport, &lport) != 2 && + sscanf(rhead->rpcb_map.r_addr, "0.0.0.0.%d.%d", + &hport, &lport) != 2) continue; - ok = sscanf(rhead->rpcb_map.r_addr, "::.%d.%d", &hport, &lport); - if (!ok) - ok = sscanf(rhead->rpcb_map.r_addr, "0.0.0.0.%d.%d", - &hport, &lport); - if (!ok) - continue; - c->port = hport << 8 | lport; - if (strcmp(rhead->rpcb_map.r_netid, TCP_PROTO) == 0 || strcmp(rhead->rpcb_map.r_netid, TCP6_PROTO) == 0) - c->proto = TCP_PROTO; + proto = TCP_PROTO; else if (strcmp(rhead->rpcb_map.r_netid, UDP_PROTO) == 0 || strcmp(rhead->rpcb_map.r_netid, UDP6_PROTO) == 0) - c->proto = UDP_PROTO; + proto = UDP_PROTO; else if (strcmp(rhead->rpcb_map.r_netid, SCTP_PROTO) == 0) - c->proto = SCTP_PROTO; + proto = SCTP_PROTO; else continue; rpc = getrpcbynumber(rhead->rpcb_map.r_prog); - if (rpc) { - strncat(prog, rpc->r_name, 128 - strlen(prog)); - c->name = strdup(prog); + if (rpc) + snprintf(prog, sizeof(prog), "rpc.%s", rpc->r_name); + else + snprintf(prog, sizeof(prog), "rpc.%lu", + (unsigned long)rhead->rpcb_map.r_prog); + + c = malloc(sizeof(*c)); + if (!c) + continue; + + c->port = hport << 8 | lport; + c->proto = proto; + c->name = strdup(prog); + if (!c->name) { + free(c); + continue; } c->next = rlist; -- 2.53.0