') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); Fix memory overwrites in SystemNative_GetNetworkInterfaces by gwr · Pull Request #125022 · dotnet/runtime · GitHub
Skip to content

Fix memory overwrites in SystemNative_GetNetworkInterfaces - #125022

Merged
wfurt merged 3 commits into
dotnet:mainfrom
gwr:bug-getif
Mar 12, 2026
Merged

Fix memory overwrites in SystemNative_GetNetworkInterfaces#125022
wfurt merged 3 commits into
dotnet:mainfrom
gwr:bug-getif

Conversation

@gwr

@gwrgwr commented Mar 1, 2026

Copy link
Copy Markdown
Contributor

Not only Android might see count = ip4count + ip6count, which would lead to overwriting the NetworkInterfaceInfo this is meant to return.

Something I discovered while working on #124728

CopilotAI review requested due to automatic review settings March 1, 2026 03:03
@dotnet-policy-servicedotnet-policy-serviceBot added the community-contribution Indicates that the PR has been added by a community member label Mar 1, 2026
@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Comment threadsrc/native/libs/System.Native/pal_interfaceaddresses.c

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a potential buffer overlap in SystemNative_GetNetworkInterfaces by ensuring the native allocation always reserves space for both the returned NetworkInterfaceInfo array and the IpAddressInfo array, even when getifaddrs returns only IPv4/IPv6 entries (so count == ip4count + ip6count).

Changes:

  • Make the allocation size always account for count + ip4count + ip6count entries to prevent overwriting the interface array.
  • Set addressList to start immediately after NetworkInterfaceInfo[count] (instead of a computed offset that can become 0).
  • Remove the Android-only conditional sizing logic and replace it with a platform-agnostic approach.

Comment threadsrc/native/libs/System.Native/pal_interfaceaddresses.c Outdated
Comment threadsrc/native/libs/System.Native/pal_interfaceaddresses.c
CopilotAI review requested due to automatic review settings March 1, 2026 03:15

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/native/libs/System.Native/pal_interfaceaddresses.c:365

  • On allocation failure, the getifaddrs() result in head is not freed before returning. This leaks the ifaddrs list in the OOM path; please call freeifaddrs(head) before setting errno/returning (and keep head valid for that call).
 void * memoryBlock = calloc((size_t)entriesCount, sizeof(NetworkInterfaceInfo));
if (memoryBlock == NULL)
{
errno = ENOMEM;
return -1;
}

Comment threadsrc/native/libs/System.Native/pal_interfaceaddresses.c
@gwr

gwr commented Mar 1, 2026

Copy link
Copy Markdown
ContributorAuthor

Fixed the assert, squash.

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Not only Android might see count = ip4count + ip6count,
which would lead to overwriting the NetworkInterfaceInfo
this is meant to return.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@gwr

gwr commented Mar 1, 2026

Copy link
Copy Markdown
ContributorAuthor

An earlier version didn't build. Someone please "kick" the CI stuff to run again.

@rzikm
rzikm requested a review from a teamMarch 2, 2026 08:08
gwr added a commit to gwr/dotnet-runtime that referenced this pull request Mar 3, 2026
Comment threadsrc/native/libs/System.Native/pal_interfaceaddresses.c

@wfurtwfurt left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTH. Thanks @gwr for the contribution.

CopilotAI review requested due to automatic review settings March 12, 2026 03:36

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.


You can also share your feedback on Copilot code review. Take the survey.

@wfurt
wfurt merged commit f7be6d5 into dotnet:mainMar 12, 2026
118 of 121 checks passed
CopilotAI pushed a commit that referenced this pull request Mar 13, 2026
Not only Android might see count = ip4count + ip6count, which would lead
to overwriting the NetworkInterfaceInfo this is meant to return.
Something I discovered while working on
#124728
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Tomas Weinfurt <tweinfurt@yahoo.com>
@github-actionsgithub-actionsBot locked and limited conversation to collaborators Apr 12, 2026
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

area-System.Netcommunity-contributionIndicates that the PR has been added by a community member

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@gwr@wfurt@teo-tsirpanis