Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tm2/pkg/p2p: *MultiplexTransport.Listen leaks net.Listener on port integerization error #3030

Open
odeke-em opened this issue Oct 27, 2024 · 1 comment
Assignees
Labels
security Security-sensitive issue

Comments

@odeke-em
Copy link

_, p, err := net.SplitHostPort(ln.Addr().String())
if err != nil {
return fmt.Errorf("error finding port (after listening on port 0): %w", err)
}
leaks the allocation listener from
ln, err := net.Listen("tcp", addr.DialString())
if err != nil {
return err
}
if addr.Port == 0 {
// net.Listen on port 0 means the kernel will auto-allocate a port
// - find out which one has been given to us.
_, p, err := net.SplitHostPort(ln.Addr().String())
if err != nil {
return fmt.Errorf("error finding port (after listening on port 0): %w", err)
}
pInt, _ := strconv.Atoi(p)
addr.Port = uint16(pInt)
}
mt.netAddr = addr
mt.listener = ln
go mt.acceptPeers()
return nil

Remedy

Please invoke ln.Close() or please use Go's named returns to help you unconditionally errors so

func (mt *MultiplexTransport) Listen(addr NetAddress) (rerr error) { 
 	ln, err := net.Listen("tcp", addr.DialString()) 
 	if err != nil { 
 		return err
        }
        defer func() {
                 if rerr != nil {
                       ln.Close()
                 }
        }()
@kristovatlas
Copy link
Contributor

Thanks for the report, @odeke-em. We're looking into it.

@kristovatlas kristovatlas self-assigned this Oct 29, 2024
@kristovatlas kristovatlas added the security Security-sensitive issue label Oct 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Security-sensitive issue
Projects
Status: Triage
Development

No branches or pull requests

2 participants