From b8cda126b4e0fbfd514b26dec4ee8a1c6849abe9 Mon Sep 17 00:00:00 2001 From: Sebastien Tardif Date: Thu, 28 May 2026 02:56:54 +0000 Subject: [PATCH 1/3] daemon: fix IPv6 address corruption in lookup_hostname() getaddrinfo() is called with AF_UNSPEC hints, so it may return IPv6 results. However, the code unconditionally casts ai_addr to sockaddr_in and passes AF_INET to inet_ntop(). On IPv6-only hosts, this reads from the wrong struct offset, producing garbage IP addresses. Fix this by checking ai_family and extracting the address pointer into a local variable before calling inet_ntop() once with the correct family. Die on unexpected address families. Signed-off-by: Sebastien Tardif Signed-off-by: Junio C Hamano --- daemon.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/daemon.c b/daemon.c index 0a7b1aae44..80fa0226d8 100644 --- a/daemon.c +++ b/daemon.c @@ -674,9 +674,20 @@ static void lookup_hostname(struct hostinfo *hi) gai = getaddrinfo(hi->hostname.buf, NULL, &hints, &ai); if (!gai) { - struct sockaddr_in *sin_addr = (void *)ai->ai_addr; + void *addr; - inet_ntop(AF_INET, &sin_addr->sin_addr, + if (ai->ai_family == AF_INET) { + struct sockaddr_in *sa = (void *)ai->ai_addr; + addr = &sa->sin_addr; + } else if (ai->ai_family == AF_INET6) { + struct sockaddr_in6 *sa6 = (void *)ai->ai_addr; + addr = &sa6->sin6_addr; + } else { + die("unexpected address family: %d", + ai->ai_family); + } + + inet_ntop(ai->ai_family, addr, addrbuf, sizeof(addrbuf)); strbuf_addstr(&hi->ip_address, addrbuf); From 30c8fda1ab6d55d3b0129bb1686c23bf06cd5b0d Mon Sep 17 00:00:00 2001 From: Sebastien Tardif Date: Thu, 28 May 2026 02:56:55 +0000 Subject: [PATCH 2/3] daemon: fix IPv6 address truncation in ip2str() The sockaddr struct size (ai_addrlen) is passed as the output buffer size to inet_ntop(). For IPv6, sizeof(sockaddr_in6) is 28 bytes but INET6_ADDRSTRLEN is 46, so long IPv6 addresses are silently truncated. Fix this by passing sizeof(ip) instead, which is the actual size of the destination buffer. Drop the now-unused len parameter from ip2str() and update all callers. Signed-off-by: Sebastien Tardif Signed-off-by: Junio C Hamano --- daemon.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/daemon.c b/daemon.c index 80fa0226d8..103c08d868 100644 --- a/daemon.c +++ b/daemon.c @@ -947,7 +947,7 @@ struct socketlist { size_t alloc; }; -static const char *ip2str(int family, struct sockaddr *sin, socklen_t len) +static const char *ip2str(int family, struct sockaddr *sin) { #ifdef NO_IPV6 static char ip[INET_ADDRSTRLEN]; @@ -958,11 +958,11 @@ static const char *ip2str(int family, struct sockaddr *sin, socklen_t len) switch (family) { #ifndef NO_IPV6 case AF_INET6: - inet_ntop(family, &((struct sockaddr_in6*)sin)->sin6_addr, ip, len); + inet_ntop(family, &((struct sockaddr_in6*)sin)->sin6_addr, ip, sizeof(ip)); break; #endif case AF_INET: - inet_ntop(family, &((struct sockaddr_in*)sin)->sin_addr, ip, len); + inet_ntop(family, &((struct sockaddr_in*)sin)->sin_addr, ip, sizeof(ip)); break; default: xsnprintf(ip, sizeof(ip), ""); @@ -1019,14 +1019,14 @@ static int setup_named_sock(char *listen_addr, int listen_port, struct socketlis if (bind(sockfd, ai->ai_addr, ai->ai_addrlen) < 0) { logerror("Could not bind to %s: %s", - ip2str(ai->ai_family, ai->ai_addr, ai->ai_addrlen), + ip2str(ai->ai_family, ai->ai_addr), strerror(errno)); close(sockfd); continue; /* not fatal */ } if (listen(sockfd, 5) < 0) { logerror("Could not listen to %s: %s", - ip2str(ai->ai_family, ai->ai_addr, ai->ai_addrlen), + ip2str(ai->ai_family, ai->ai_addr), strerror(errno)); close(sockfd); continue; /* not fatal */ @@ -1080,7 +1080,7 @@ static int setup_named_sock(char *listen_addr, int listen_port, struct socketlis if ( bind(sockfd, (struct sockaddr *)&sin, sizeof sin) < 0 ) { logerror("Could not bind to %s: %s", - ip2str(AF_INET, (struct sockaddr *)&sin, sizeof(sin)), + ip2str(AF_INET, (struct sockaddr *)&sin), strerror(errno)); close(sockfd); return 0; @@ -1088,7 +1088,7 @@ static int setup_named_sock(char *listen_addr, int listen_port, struct socketlis if (listen(sockfd, 5) < 0) { logerror("Could not listen to %s: %s", - ip2str(AF_INET, (struct sockaddr *)&sin, sizeof(sin)), + ip2str(AF_INET, (struct sockaddr *)&sin), strerror(errno)); close(sockfd); return 0; From 422a5bf57575a8c5d06faedfd77376501917e22c Mon Sep 17 00:00:00 2001 From: Sebastien Tardif Date: Thu, 28 May 2026 02:56:56 +0000 Subject: [PATCH 3/3] daemon: guard NULL REMOTE_PORT in execute() logging REMOTE_ADDR and REMOTE_PORT are both set by the same code path in handle(), so when the existing REMOTE_ADDR check passes, REMOTE_PORT is guaranteed to be non-NULL. Guard REMOTE_PORT as well so that a future change that breaks this invariant does not pass NULL to printf's %s, which is undefined behavior. Signed-off-by: Sebastien Tardif Signed-off-by: Junio C Hamano --- daemon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/daemon.c b/daemon.c index 103c08d868..78cca8673f 100644 --- a/daemon.c +++ b/daemon.c @@ -753,7 +753,7 @@ static int execute(void) struct strvec env = STRVEC_INIT; if (addr) - loginfo("Connection from %s:%s", addr, port); + loginfo("Connection from %s:%s", addr, port ? port : "?"); set_keep_alive(0); alarm(init_timeout ? init_timeout : timeout);