BUG/MINOR: quic: fix buffer overflow with sockaddr_in46

New type sockaddr_in46 has been recently introduced. It serves as a
union which can store either an IPv4 or IPv6 address. The objective is
to reduce the storage size for QUIC datagrams which previously uses a
sockaddr_storage field.

On qc_new_conn(), source and destination addresses from the datagram are
passed to the function as sockaddr_storage so that they are copied into
the newly built quic_conn instance. However, the involved memcpy() is
producing a buffer overflow as sockaddr_in46 is smaller than
sockaddr_storage type.

This patch fixes this by defining a new helper function
in46union_to_addr(). This allows to convert safely sockaddr_in46 to a
plain sockaddr type. The function is now used before invoking
qc_new_conn().

No need to backport.

Author: a-denoyelle

include/haproxy/quic_sock.h

@@ -109,6 +109,36 @@ static inline int quic_increment_curr_handshake(struct listener *l)
 	return next;
 }
 
+/* Initializes <dst> sockaddr_storage from <src> union sockaddr_in46 type.
+ * Only IP version 4 and 6 addresses are supported.
+ */
+static inline void in46union_to_addr(const union sockaddr_in46 *src,
+                                     struct sockaddr_storage *dst)
+{
+	struct sockaddr_in  *in;
+	struct sockaddr_in6 *in6;
+
+	switch (((struct sockaddr_storage *)src)->ss_family) {
+	case AF_INET:
+		in = (struct sockaddr_in *)dst;
+		in->sin_family = AF_INET;
+		in->sin_addr = src->in4.sin_addr;
+		in->sin_port = src->in4.sin_port;
+		break;
+
+	case AF_INET6:
+		in6 = (struct sockaddr_in6 *)dst;
+		in6->sin6_family = AF_INET6;
+		in6->sin6_addr = src->in6.sin6_addr;
+		in6->sin6_port = src->in6.sin6_port;
+		break;
+
+	default:
+		ABORT_NOW();
+		break;
+	}
+}
+
 #endif /* USE_QUIC */
 #endif /* _HAPROXY_QUIC_SOCK_H */
 

src/quic_rx.c

@@ -1868,9 +1868,12 @@ static struct quic_conn *quic_rx_pkt_retrieve_conn(struct quic_rx_packet *pkt,
 				pool_free(pool_head_quic_connection_id, conn_id);
 			}
 			else {
+				struct sockaddr_storage saddr, daddr;
+				in46union_to_addr(&pkt->saddr, &saddr);
+				in46union_to_addr(&dgram->daddr, &daddr);
+
 				qc = qc_new_conn(l, pkt, &token_odcid, NULL, conn_id,
-				                 (struct sockaddr_storage *)&dgram->daddr,
-				                 (struct sockaddr_storage *)&pkt->saddr);
+				                 &daddr, &saddr);
 				if (qc == NULL) {
 					quic_cid_delete(conn_id); /* Removes CID from global tree as it points to a NULL qc. */
 					pool_free(pool_head_quic_connection_id, conn_id);