Skip to content

fix(ext/http): avoid misaligned sockaddr_in access in SocketAddr constructor - #4629

Open
Shubhammehta2008 wants to merge 21 commits into
open-telemetry:mainfrom
Shubhammehta2008:fix-socketaddr-misaligned-cast
Open

Shubhammehta2008 wants to merge 21 commits into
open-telemetry:mainfrom
Shubhammehta2008:fix-socketaddr-misaligned-cast

Conversation

@Shubhammehta2008

@Shubhammehta2008 Shubhammehta2008 commented Sep 22, 2026 •

Copy link
Copy Markdown

Fixes #4307

Changes

Avoids undefined behavior caused by binding a sockaddr_in & to m_data through reinterpret_cast in the SocketAddr(u_long, uint16_t) constructor.

The fix is to declare m_data as sockaddr_storage.

For significant contributions please make sure you have completed the following items:

  • CHANGELOG.md updated for non-trivial changes
  • Unit tests have been added
  • Changes in public API reviewed

@Shubhammehta2008
Shubhammehta2008 requested a review from a team as a code owner September 22, 2026 17:14
@linux-foundation-easycla

linux-foundation-easycla Bot commented Sep 22, 2026 •

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

  • ✅ login: Shubhammehta2008 / name: shubham mehta (0f208c6)

@marcalff marcalff left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the patch.

Please see comments, the proper fix is to use sockaddr_storage to represent a socket in an arbitrary protocol.

Other places using m_data may need some cleanup.

Comment thread ext/include/opentelemetry/ext/http/server/socket_tools.h Outdated
@codecov

codecov Bot commented Sep 22, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 91.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 86.67%. Comparing base (107a1b5) to head (77c6861).

Files with missing lines Patch % Lines
...clude/opentelemetry/ext/http/server/socket_tools.h 91.67% 1 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #4629      +/-   ##
==========================================
+ Coverage   86.66%   86.67%   +0.01%     
==========================================
  Files         525      525              
  Lines       20543    20542       -1     
==========================================
+ Hits        17802    17803       +1     
+ Misses       2741     2739       -2     
Files with missing lines Coverage Δ
...clude/opentelemetry/ext/http/server/socket_tools.h 95.66% <91.67%> (-0.02%) ⬇️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Shubhammehta2008

Copy link
Copy Markdown
Author

Updated the tests to use ss_family for sockaddr_storage to resolve the Windows build failure. Please approve the workflow runs and take another look when you get a chance.

Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/include/opentelemetry/ext/http/server/socket_tools.h
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated

@marcalff marcalff left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks much better.

See comments.

Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated

@marcalff marcalff left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See remaining cleanup

Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Comment thread ext/test/http/socket_tools_test.cc Outdated
Co-authored-by: Marc Alff <marc.alff@free.fr>
Comment thread ext/include/opentelemetry/ext/http/server/socket_tools.h Outdated
Comment thread ext/include/opentelemetry/ext/http/server/socket_tools.h Outdated
Comment thread ext/include/opentelemetry/ext/http/server/socket_tools.h Outdated
Comment thread ext/include/opentelemetry/ext/http/server/socket_tools.h Outdated
Co-authored-by: Marc Alff <marc.alff@free.fr>
Comment thread ext/include/opentelemetry/ext/http/server/socket_tools.h Outdated
Co-authored-by: Marc Alff <marc.alff@free.fr>
Comment on lines 301 to 305
// The parser memcpys a sockaddr_in into m_data, and the socket syscalls pass sizeof(SocketAddr)
// as the address length. This wrapper is IPv4-only, so require sockaddr and sockaddr_in to have
// the exact same size rather than trusting every ABI: passing an address length that is too large
// for the family is a documented EINVAL for connect()/bind(). Exact equality also keeps the memcpy
// safe. Together with the assertion below, sizeof(SocketAddr) == sizeof(sockaddr_in).

@marcalff marcalff Oct 1, 2026 •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is no longer true, now that m_data is aligned, but bigger than sockaddr_in.

I suspect this is what makes the test fail on MacOS, providing a length greater that sizeof(sockaddr_in).

Please implement:

  • a method addr() to return &m_data
  • a method addr_len() to return sizeof(sockaddr_in), since only AF_INET is supported anyway.

Use these methods when calling bind / connect, to pass the proper addr.addr() and addr.addr_len() to the networking code.

@marcalff marcalff left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See MacOS runtime failures, and possible fix.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] SocketAddr(u_long, int) performs misaligned sockaddr_in access and truncates out-of-range ports

3 participants