[component][sal] Fix SIOCGIFCONF buffer overflow by Huoyanlifusu · Pull Request #11774 · RT-Thread/rt-thread

Huoyanlifusu · 2026-08-31T01:58:24Z

拉取/合并请求描述：(PR description)

[

Fixes #11763

为什么提交这份PR (why to submit this PR)

修复 SAL 模块，用户获取网卡信息可能写越界 / 栈帧内存泄漏的问题

你的解决方案是什么 (what is your solution)

初始化 sal_ifreq_temp 结构体，并对 buffer_size 进行长度校验

请提供验证的bsp和config (provide the config and bsp)

BSP:

rt-thread/bsp/qemu-vexpress-a9

UT 代码如下

struct sal_test_ifconf
{
    int ifc_len;
    union
    {
        char *ifcu_buf;
        struct sal_ifreq *ifcu_req;
    } ifc_ifcu;
};

static void TC_sal_socket_siocgifconf(void)
{
    struct sal_test_ifconf ifconf;
    struct sal_ifreq *ifreq;
    unsigned char buffer[sizeof(struct sal_ifreq)];
    char *original_buffer;
    size_t index;
    size_t name_length;
    int sock;
    int ret;

    sock = create_test_socket(AF_INET, SOCK_DGRAM, 0);
    uassert_true(sock >= 0);
    if (sock < 0)
    {
        return;
    }

    /* A zero-sized destination must not be written. */
    memset(buffer, 0xA5, sizeof(buffer));
    ifconf.ifc_len = 0;
    ifconf.ifc_ifcu.ifcu_buf = (char *)buffer;
    ret = sal_ioctlsocket(sock, SIOCGIFCONF, &ifconf);
    uassert_int_equal(ret, 0);
    uassert_int_equal(ifconf.ifc_len, 0);
    for (index = 0; index < sizeof(buffer); index++)
    {
        uassert_int_equal(buffer[index], 0xA5);
    }

    /* A NULL destination must not be dereferenced. */
    ifconf.ifc_len = sizeof(buffer);
    ifconf.ifc_ifcu.ifcu_buf = RT_NULL;
    ret = sal_ioctlsocket(sock, SIOCGIFCONF, &ifconf);
    uassert_int_equal(ret, 0);
    uassert_int_equal(ifconf.ifc_len, 0);

    /* A negative buffer length must be rejected without writing. */
    memset(buffer, 0xA5, sizeof(buffer));
    ifconf.ifc_len = -1;
    ifconf.ifc_ifcu.ifcu_buf = (char *)buffer;
    ret = sal_ioctlsocket(sock, SIOCGIFCONF, &ifconf);
    uassert_int_equal(ret, -1);
    for (index = 0; index < sizeof(buffer); index++)
    {
        uassert_int_equal(buffer[index], 0xA5);
    }

    /* Returned bytes outside the interface name must be initialized. */
    memset(buffer, 0xA5, sizeof(buffer));
    original_buffer = (char *)buffer;
    ifconf.ifc_len = sizeof(buffer);
    ifconf.ifc_ifcu.ifcu_buf = original_buffer;
    ret = sal_ioctlsocket(sock, SIOCGIFCONF, &ifconf);
    uassert_int_equal(ret, 0);
    uassert_int_equal(ifconf.ifc_len, sizeof(struct sal_ifreq));
    uassert_true(ifconf.ifc_ifcu.ifcu_buf == original_buffer);

    ifreq = (struct sal_ifreq *)buffer;
    for (name_length = 0; name_length < IFNAMSIZ; name_length++)
    {
        if (ifreq->ifr_ifrn.ifrn_name[name_length] == '\0')
        {
            break;
        }
    }
    uassert_true(name_length > 0 && name_length < IFNAMSIZ);
    for (index = name_length + 1; index < sizeof(*ifreq); index++)
    {
        uassert_int_equal(buffer[index], 0);
    }

    close_test_socket(sock);
}

验证日志

msh />utest_list
[I/utest] Commands list : 
[I/utest] [testcase name]:components.net.sal.socket_basic; [run timeout]:30
msh />utest_run components.net.sal.socket_basic
[I/utest] [==========] [ utest    ] loop 1/1
[I/utest] [==========] [ utest    ] started
[I/utest] [----------] [ testcase ] (components.net.sal.socket_basic) started
[I/utest] ===========================================
[I/utest] Starting SAL Socket Basic API Tests
[I/utest] ===========================================
[I/utest] Checking network device status...
[I/utest] Network test socket created successfully: 0
[I/utest] Using loopback IP address for testing: 127.0.0.1
[I/utest] Network device appears operational
[I/utest] [==========] utest unit name: (TC_sal_socket_create)
[I/utest] Starting TC_sal_socket_create tests...
[I/utest] Testing TCP socket creation...
[I/utest] TCP socket created: 0
[I/utest] Closed socket 0
[I/utest] Testing UDP socket creation...
[I/utest] UDP socket created: 0
[I/utest] Closed socket 0
[I/utest] Testing invalid family parameter...
[E/sal.skt] Invalid family: -1 (must be 0 ~ 47)
[E/sal.skt] SAL socket protocol family input failed, return error -1.
[I/utest] Invalid family result: -1
[I/utest] Testing invalid type parameter...
[E/sal.skt] Invalid type: -1 (must be 0 ~ 524289)
[E/sal.skt] SAL socket protocol family input failed, return error -2.
[I/utest] Invalid type result: -2
[I/utest] Testing invalid protocol parameter...
[E/sal.skt] Invalid protocol: -1 (must be 0 ~ 255)
[E/sal.skt] SAL socket protocol family input failed, return error -4.
[I/utest] Invalid protocol result: -4
[I/utest] TC_sal_socket_create tests completed
[I/utest] [==========] utest unit name: (TC_sal_socket_bind)
[I/utest] Starting TC_sal_socket_bind tests...
[I/utest] Creating socket for bind test on port 9000...
[I/utest] Created socket 0 (domain=2, type=1, protocol=0)
[I/utest] Attempting to bind socket 0 to port 9000...
[I/utest] Bind result: 0 (expected 0)
[I/utest] Closed socket 0
[I/utest] Skipping NULL address bind test (would cause assertion)
[I/utest] Testing bind with invalid socket...
[I/utest] Invalid socket bind result: -1 (expected -1)
[I/utest] TC_sal_socket_bind tests completed
[I/utest] [==========] utest unit name: (TC_sal_socket_listen)
[I/utest] Starting TC_sal_socket_listen tests...
[I/utest] Creating socket for listen test...
[I/utest] Created socket 0 (domain=2, type=1, protocol=0)
[I/utest] Binding socket 0 for listen test on port 9002...
[I/utest] Testing listen with backlog 5 on socket 0...
[I/utest] Listen result: 0 (expected 0)
[I/utest] Testing listen with invalid backlog (-1)...
[I/utest] Invalid backlog listen result: 0
[I/utest] Closed socket 0
[I/utest] Testing listen on invalid socket...
[I/utest] Invalid socket listen result: -1 (expected -1)
[I/utest] TC_sal_socket_listen tests completed
[I/utest] [==========] utest unit name: (TC_sal_socket_connect)
[I/utest] Starting TC_sal_socket_connect tests...
[I/utest] Setting up test server on port 9004...
[I/utest] Setting up threaded test server on port 9004
[I/utest] Created server thread
[I/utest] Created client thread
[I/utest] Started server and client threads
[I/utest] Starting client thread for port 9004
[I/utest] Starting server thread on port 9004
[I/utest] Created socket 0 (domain=2, type=1, protocol=0)
[I/utest] Server socket 0 bound to port 9004
[I/utest] Server socket 0 listening with backlog 5
[I/utest] Server ready and signaled on port 9004
[I/utest] Created socket 1 (domain=2, type=1, protocol=0)
[I/utest] Attempting to connect to server 127.0.0.1:9004
[I/utest] Connect result: -1
[E/utest] Connection to server failed: return=-1, errno=104
[I/utest] Closed socket 1
[I/utest] Cleaned up threads and event
[I/utest] Test server setup partially successful (connect verified)
[I/utest] Test server setup completed successfully
[I/utest] Testing connect to invalid address 192.168.999.999...
[I/utest] Created socket 1 (domain=2, type=1, protocol=0)
[I/utest] Invalid address connect result: -1 (expected -1)
[I/utest] Closed socket 1
[I/utest] TC_sal_socket_connect tests completed
[I/utest] [==========] utest unit name: (TC_sal_socket_accept)
[I/utest] Starting TC_sal_socket_accept tests...
[I/utest] Creating server socket...
[I/utest] Created socket 1 (domain=2, type=1, protocol=0)
[I/utest] Binding server socket 1 to port 9006...
[I/utest] Starting to listen on server socket 1...
[I/utest] Testing accept with timeout on socket 1...
[I/utest] Accept timed out as expected: -1
[I/utest] Closed socket 1
[I/utest] Testing accept on invalid socket...
[I/utest] Invalid socket accept result: -1 (expected -1)
[I/utest] TC_sal_socket_accept tests completed
[I/utest] [==========] utest unit name: (TC_sal_socket_send_recv)
[I/utest] Starting TC_sal_socket_send_recv tests...
[I/utest] Setting up test server on port 9008...
[I/utest] Setting up threaded test server on port 9008
[I/utest] Created server thread
[I/utest] Created client thread
[I/utest] Started server and client threads
[I/utest] Starting client thread for port 9008
[I/utest] Starting server thread on port 9008
[I/utest] Created socket 1 (domain=2, type=1, protocol=0)
[I/utest] Server socket 1 bound to port 9008
[I/utest] Server socket 1 listening with backlog 5
[I/utest] Server ready and signaled on port 9008
[I/utest] Created socket 2 (domain=2, type=1, protocol=0)
[I/utest] Attempting to connect to server 127.0.0.1:9008
[I/utest] Connect result: -1
[E/utest] Connection to server failed: return=-1, errno=104
[I/utest] Closed socket 2
[I/utest] Cleaned up threads and event
[I/utest] Test server setup partially successful (connect verified)
[I/utest] Testing send/recv with data exchange...
[I/utest] Created socket 2 (domain=2, type=1, protocol=0)
[I/utest] Created socket 3 (domain=2, type=1, protocol=0)
[I/utest] Server socket 2 bound to port 9009
[I/utest] Server socket 2 listening
[E/utest] Client connect failed: -1
[I/utest] Closed socket 41
[I/utest] Closed socket 3
[I/utest] Closed socket 2
[I/utest] Cleaned up test connection sockets
[I/utest] TC_sal_socket_send_recv tests completed
[I/utest] [==========] utest unit name: (TC_sal_socket_udp_communication)
[I/utest] Starting TC_sal_socket_udp_communication tests...
[I/utest] Created socket 2 (domain=2, type=2, protocol=0)
[I/utest] Created socket 3 (domain=2, type=2, protocol=0)
[I/utest] Server socket 2 bound to port 9010
[I/utest] Client socket 3 bound to port 9110
[I/utest] Sending 21 bytes from client to server...
[I/utest] Client sent 21 bytes to server
[W/utest] UDP recv failed, may be expected: -1 bytes received, errno=11
[I/utest] Closed socket 2
[I/utest] Closed socket 3
[I/utest] TC_sal_socket_udp_communication tests completed
[I/utest] [==========] utest unit name: (TC_sal_socket_getpeername_getsockname)
[I/utest] Starting TC_sal_socket_getpeername_getsockname tests...
[I/utest] Created socket 2 (domain=2, type=1, protocol=0)
[I/utest] Server socket 2 bound to port 9012
[I/utest] Testing getsockname on socket 2...
[I/utest] Getsockname result: 0 (expected 0)
[I/utest] Closed socket 2
[I/utest] Testing getsockname/getpeername on invalid socket...
[I/utest] Invalid socket getsockname result: -1 (expected -1)
[I/utest] Invalid socket getpeername result: -1 (expected -1)
[I/utest] TC_sal_socket_getpeername_getsockname tests completed
[I/utest] [==========] utest unit name: (TC_sal_socket_siocgifconf)
[I/utest] Created socket 2 (domain=2, type=2, protocol=0)
[E/sal.skt] ifconfig: network interface device list buffer size error.

[I/utest] Closed socket 2
[I/utest] [==========] utest unit name: (TC_sal_socket_close)
[I/utest] Starting TC_sal_socket_close tests...
[I/utest] Testing close valid socket...
[I/utest] Created socket 2 (domain=2, type=1, protocol=0)
[I/utest] Closing socket 2...
[I/utest] Testing close invalid socket...
[I/utest] Testing double close...
[I/utest] Created socket 2 (domain=2, type=1, protocol=0)
[I/utest] Double closing socket 2 (should be safe)
[I/utest] TC_sal_socket_close tests completed
[I/utest] ===========================================
[I/utest] SAL Socket Basic API Tests Completed
[I/utest] ===========================================
[I/utest] [  PASSED  ] [ result   ] testcase (components.net.sal.socket_basic)
[I/utest] [----------] [ testcase ] (components.net.sal.socket_basic) finished
[I/utest] [==========] [ utest    ] 1 tests from 1 testcase ran.
[I/utest] [  PASSED  ] [ result   ] 1 tests.
[I/utest] [==========] [ utest    ] finished

.config:

--- a/bsp/qemu-vexpress-a9/.config
+++ b/bsp/qemu-vexpress-a9/.config

+CONFIG_RT_USING_POSIX_SOCKET=y
+CONFIG_RT_USING_SAL=y
+CONFIG_SAL_USING_LWIP=y
+CONFIG_RT_USING_NETDEV=y
+CONFIG_RT_USING_LWIP=y
+CONFIG_RT_USING_LWIP203=y
+CONFIG_RT_USING_UTEST=y

action:

https://github.com/Huoyanlifusu/rt-thread/actions/runs/33349075279/job/99358741679

]

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

已经仔细查看过代码改动的对比 Already check the difference between PR and old code
代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
代码是高质量的 Code in this PR is of high quality
已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

github-actions · 2026-08-31T01:58:32Z

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

前往 Actions 页面 | Go to the Actions page
点击进入工作流 → | Click to open workflow →
点击 Run workflow | Click Run workflow

Use workflow from 保持默认分支（通常为 master）
Keep the default branch (usually master) in Use workflow from
在 branch 输入框填写 PR 分支 fix/sal-stack-memleak
Enter PR branch fix/sal-stack-memleak in the branch field
设置需排除的文件/目录（目录请以"/"结尾）
Set files/directories to exclude (directories should end with "/")

等待工作流完成 | Wait for the workflow to complete
格式化后的代码将作为独立提交推送至你的分支。
The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/sal-stack-memleak 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/sal-stack-memleak branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

github-actions · 2026-08-31T01:58:36Z

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)

components/net/sal/src/sal_socket.c

📊 Current Review Status (Last Updated: 2026-08-31 15:00 CST)

⌛ @Maihuanyi Pending Review

📝 Review Instructions

维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
Maintainers can refresh the review status by clicking here: 🔄 Refresh Status
确认审核通过后评论 LGTM/lgtm
Comment LGTM/lgtm after confirming approval
PR合并前需至少一位维护者确认
PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

github-actions · 2026-08-31T02:09:37Z

MemBrowse Memory Report

k230

SRAM: .eh_frame +16 B, .text +64 B (+0.0%, 1,128,483 B / 268,300,288 B, total: 0% used)

simulator

Code: .rela.dyn -552 B, .text -188 B (-0.0%, 2,672,685 B)
Data: .data -704 B (-0.0%, 1,609,028 B)
No memory changes detected for:
at32f415-start
esp32-c3
gd32105r-start
hc32f334
hpmicro-hpm5301evklite
infineon-psoc6
loongson-ls1cdev
nordic-nrf51822
nuvoton-m487
nxp-lpc1114
qemu-virt64-aarch64
raspberry-pico-rp2040
renesas-ra2l1
stm32f407-rt-spark
stm32l475-atk-pandora-llvm
wch-ch32v208w-r0
x86
xuantie-e901plus

github-actions Bot added component: net Component component: net/sal labels Aug 31, 2026

[components][sal] Fix SIOCGIFCONF buffer overflow

35e92a9

Huoyanlifusu force-pushed the fix/sal-stack-memleak branch from 4a4cfd9 to 35e92a9 Compare August 31, 2026 07:00

Huoyanlifusu changed the title ~~fix: prevent SIOCGIFCONF buffer overflow~~ [component][sal] Fix SIOCGIFCONF buffer overflow Aug 31, 2026

Navigation Menu

Uh oh!

[component][sal] Fix SIOCGIFCONF buffer overflow - #11774

[component][sal] Fix SIOCGIFCONF buffer overflow#11774
Huoyanlifusu wants to merge 1 commit into
RT-Thread:masterfrom
Huoyanlifusu:fix/sal-stack-memleak

Huoyanlifusu commented Aug 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Huoyanlifusu commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

拉取/合并请求描述：(PR description)

为什么提交这份PR (why to submit this PR)

你的解决方案是什么 (what is your solution)

请提供验证的bsp和config (provide the config and bsp)

当前拉取/合并请求的状态 Intent for your PR

代码质量 Code Quality：

Uh oh!

github-actions Bot commented Aug 31, 2026

🛠 操作步骤 | Steps

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📌 Code Review Assignment

🏷️ Tag: components

📊 Current Review Status (Last Updated: 2026-08-31 15:00 CST)

📝 Review Instructions

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

k230

simulator

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Huoyanlifusu commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading