Skip to content

set_acceptfilter() passes reference instead of value to setsockopt, sending 8 bytes instead of struct #459

@SebTardif

Description

@SebTardif

Bug

In library/std/src/sys/net/connection/socket/unix.rs:511, set_acceptfilter() passes &mut arg (a reference) to the generic setsockopt<T>. Since T is inferred as &mut libc::accept_filter_arg, size_of::<T>() is 8 (pointer size on 64-bit) instead of size_of::<accept_filter_arg>() (~256 bytes).

The kernel receives 8 bytes of pointer data instead of the actual struct, so setsockopt(SO_ACCEPTFILTER) silently fails or sets garbage.

The empty-name branch has a similar issue: it passes null_mut() as *mut c_void, so T = *mut c_void and the kernel gets a pointer to a stack null pointer with length 8, rather than a null pointer with length 0.

Impact

set_acceptfilter() is completely non-functional on FreeBSD and NetBSD. Behind #[unstable(feature = "acceptfilter")].

Note: the getter acceptfilter() has a separate bug (dangling &CStr) tracked in #233.

Fix

Pass arg by value (not by reference) so T = accept_filter_arg:

unsafe { setsockopt(self, libc::SOL_SOCKET, libc::SO_ACCEPTFILTER, arg) }

Metadata

Metadata

Assignees

No one assigned

    Labels

    I-wrongWrong result or data corruptionO-freebsdFreeBSD / NetBSDbugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions