Vfrdtyky

I try to create a socket and connect to a remote host. I resolve the remote host from domain with GetAddrInfo. Which works fine. After the call i get a working addrinfo struct with the right values. But in some situations the struct gets corrupted before calling connect().

struct addrinfoW sa = { 0 };

ZeroMemory(&sa, sizeof(sa));

lookup_host(host, &sa);



int sock = 0;

sock = socket(AF_INET, SOCK_STREAM, 0);

if(sock == -1) {

    return -1;

}

HeapValidate(GetProcessHeap(), HEAP_NO_SERIALIZE, NULL);

if(connect(sock, sa->ai_addr, sa->ai_addrlen) < 0) {

    HeapValidate(GetProcessHeap(), HEAP_NO_SERIALIZE, NULL);

#ifdef _DEBUG

    printf("Error: %dn", GetLastError());

#endif // _DEBUG



    return -2;

}

Where lookup_host is defined as:

struct addrinfoW hints = { 0 };

struct addrinfoW *res;

int errcode;

ZeroMemory(&hints, sizeof(struct addrinfoW));

//ZeroMemory(res, sizeof(struct addrinfo));

hints.ai_family = PF_UNSPEC;

hints.ai_socktype = SOCK_STREAM;

hints.ai_flags |= AI_CANONNAME;

errcode = GetAddrInfo(host, L"80", &hints, &res);//GetAddrInfoExW(L"google.de", L"80", NS_ALL, NULL, &hints, &res, NULL, NULL, NULL, NULL);  //GetAddrInfoEX(L"google.de", L"80", &hints, &res);

win_free(mbHost);

if (errcode != 0)

{

    //perror("getaddrinfo");

    return -1;

}

void *ptr = 0;

while (res)

{

    switch (res->ai_family)

    {

    case AF_INET:

        ptr = &((struct sockaddr_in *) res->ai_addr)->sin_addr;

        break;

    case AF_INET6:

        ptr = &((struct sockaddr_in6 *) res->ai_addr)->sin6_addr;

        break;

    }

    CopyMemory(out, res, sizeof(struct addrinfoW));

    break;

    res = res->ai_next;

}

FreeAddrInfo(res);

So this works well on my Quad-Core Win10 laptop. But if i add for example a

MessageBoxA(NULL, "After sock", "HTTP", MB_ICONWARNING|MB_CANCELTRYCONTINUE | MB_DEFBUTTON2);

call before the connect() call and examine the addrinfo struct in debugger it gets corrupted. For example some time i can see that the ai_canonname which should be "google.com" get overwritten with "After Sock". But the heap is still valid after that.
So i have no idea where to start debugging this. Could it be some other buffer or struct which overflows somewhere?

It's because you free all the memory associated with the results before you use it. For example ai_canonname is a pointer to a string that is allocated from the heap. The memory containing its bytes is flagged as free for reuse before you exit lookup_host. Your CopyMemory will copy the pointer but not the bytes it points to.

NB you should post the whole of lookup_host including the function definition.

You need to find a way of avoiding the call to FreeAddrInfo until after you are done. Either that or do a deeper copy of the struct including all the things being pointed to which you will find rapidly turns into a rabbit hole.

The way I would do it is to provide a callback function that is called while inside lookup_host

your while (res) is moving the pointer res to other nodes other the origibal one each time you execute line res = res->ai_next;, but then you call FreeAddrInfo(res); at the end with modified pointer, not the one allocated via GetAddrInfo.

Also, although you don't provide the start of the lookup_host function, but assuming an inout is ptr, you are setting it to the address of sin_addr from the allocated emory, and then freeing the memory at the end of the function, so it may be used by something else.

Your lookup_host() is not returning address data back to the caller correctly, not even close. addrinfo contains pointers to data outside of the addrinfo. But you are just copying the addrinfo itself to the caller, but none of the data it points at.

Try something more like this instead:

int lookup_host(const wchar_t *host, int family, void *sa)

{

    struct addrinfoW hints;

    struct addrinfoW *res, *addr;

    int errcode, addrlen, returnval;

    void *ptr;



    ZeroMemory(&hints, sizeof(hints));

    hints.ai_family = family;

    hints.ai_socktype = SOCK_STREAM;



    errcode = GetAddrInfoW(host, L"80", &hints, &res);

    //GetAddrInfoExW(host, L"80", NS_ALL, NULL, &hints, &res, NULL, NULL, NULL, NULL);

    if (errcode != 0)

    {

        //perror("getaddrinfo");

        return -1;

    }



    returnval = 0;



    for(addr = res; addr != NULL; addr = addr->ai_next)

    {

        switch (addr->ai_family)

        {

            case AF_INET:

                ptr = &((struct sockaddr_in *) addr->ai_addr)->sin_addr;

                addrlen = sizeof(struct sockaddr_in);

                break;



            case AF_INET6:

                ptr = &((struct sockaddr_in6 *) res->ai_addr)->sin6_addr;

                addrlen = sizeof(struct sockaddr_in6);

                break;



            default:

                continue;

        }



        CopyMemory(sa, ptr, addrlen);

        returnval = 1;

        break;

    }



    FreeAddrInfoW(res);



    return returnval;

}



...



struct sockaddr_in sa;



if (lookup_host(host, AF_INET, &sa) != 1) {

    return -1;

}



SOCKET sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

if (sock == INVALID_SOCKET) {

    return -1;

}



if (connect(sock, (struct sockaddr *)&sa, sizeof(sa)) < 0) {

    #ifdef _DEBUG

    printf("Error: %dn", GetLastError());

    #endif // _DEBUG



    closesocket(sock);

    return -2;

}



...

Note, however, that the above returns only the first address found. A hostname can resolve to multiple IPs, and your PC might not have a route to all of them. So, you should attempt to connect to every address reported until one is successful, eg:

int lookup_host(const wchar_t *host, int family, struct addrinfoW **addrs)

{

    struct addrinfoW hints;

    int errcode;



    ZeroMemory(&hints, sizeof(hints));

    hints.ai_family = family;

    hints.ai_socktype = SOCK_STREAM;



    errcode = GetAddrInfoW(host, L"80", &hints, addrs);

    //GetAddrInfoExW(host, L"80", NS_ALL, NULL, &hints, addrs, NULL, NULL, NULL, NULL);

    if (errcode != 0)

    {

        //perror("getaddrinfo");

        return -1;

    }



    return 0;

}



...



struct addrInfoW *res, *addr;



if (lookup_host(host, AF_INET, &res) < 0) { // or AF_INET6, or AF_UNSPEC

    return -1;

}



sock = INVALID_SOCKET;



for(addr = res; addr != NULL; addr = addr->ai_next)

{

    sock = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);

    if (sock == INVALID_SOCKET) {

        break;

    }



    if (connect(sock, addr->ai_addr, addr->ai_addrlen) == 0) {

        break;

    }



    #ifdef _DEBUG

    printf("Error: %dn", GetLastError());

    #endif // _DEBUG



    closesocket(sock);

    sock = INVALID_SOCKET;

}



FreeAddrInfoW(res);



if (sock == INVALID_SOCKET) {

    return -2;

}



...