From c417ccb7f96230649598d1a52b581ba6bb9eb317 Mon Sep 17 00:00:00 2001 From: Dimitris Panokostas Date: Tue, 15 Sep 2026 20:55:57 +0200 Subject: [PATCH] fix(network): bound gethostname copy to guest namelen trap_put_string() writes through the terminating NUL and ignores its maxlen on the direct-memory path, so a hostname longer than the caller's buffer spilled past the validated namelen range into adjacent guest memory. Truncate to namelen-1 plus NUL and copy with the strictly bounded trap_put_bytes(). --- src/bsdsocket.cpp | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/bsdsocket.cpp b/src/bsdsocket.cpp index 0a3baf8f7..59273c60f 100644 --- a/src/bsdsocket.cpp +++ b/src/bsdsocket.cpp @@ -2144,13 +2144,23 @@ uae_u32 host_Inet_MakeAddr(uae_u32 net, uae_u32 host) uae_u32 host_gethostname(TrapContext *ctx, uae_u32 name, uae_u32 namelen) { + char buf[256]; + size_t len; + if (!trap_valid_address(ctx, name, namelen)) return -1; - char buf[256]; + if (namelen == 0) + return -1; if (gethostname(buf, sizeof(buf)) != 0) return -1; buf[sizeof(buf) - 1] = '\0'; - trap_put_string(ctx, (uae_char *)buf, name, namelen); + len = strlen(buf); + if (len >= namelen) + len = namelen - 1; /* caller's buffer too small: truncate */ + buf[len] = '\0'; + /* trap_put_string() copies through the terminating NUL and ignores its + * maxlen on the direct-memory path, so use a strictly bounded copy */ + trap_put_bytes(ctx, buf, name, (int)(len + 1)); return 0; }