Skip to content

nul-terminate cookie read from control connection in iperf_accept - #2054

Open
dxbjavid wants to merge 1 commit into
esnet:masterfrom
dxbjavid:cookie-nul-terminate
Open

nul-terminate cookie read from control connection in iperf_accept#2054
dxbjavid wants to merge 1 commit into
esnet:masterfrom
dxbjavid:cookie-nul-terminate

Conversation

@dxbjavid

@dxbjavid dxbjavid commented Jul 2, 2026

Copy link
Copy Markdown
Contributor
  • Version of iperf3 (or development branch, such as master or
    3.1-STABLE) to which this pull request applies: master

  • Issues fixed (if any): none

  • Brief description of code changes (suitable for use as a commit message):

on the server, iperf_accept() reads exactly COOKIE_SIZE bytes from the client's control connection into test->cookie (a char[COOKIE_SIZE]) but never forces a terminating NUL, whereas a well behaved client only sends 36 characters plus a trailing NUL. A peer that sends 37 non-NUL bytes leaves the buffer unterminated, and it is then handled as a C string in iperf_on_connect() (copied into the JSON cookie field and printed via report_cookie), so strlen reads past the array into the following struct members. This terminates the cookie right after it is read so the later string handling stays in bounds.

@bmah888

bmah888 commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Thanks for the bug report and PR! We'll take a look.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants