Add input validation for socket connection definitions (#21881)
- Ensure `definition` is not null or empty in `connect_to_this()` and `nd_sock_connect_to_this()`. - Log errors and return appropriate error codes for invalid inputs. Co-authored-by: Ilya Mashchenko <ilya@netdata.cloud>
Stelios Fragkakis committed
Mar 4, 2026 at 22:43 UTC
c6f21a8c5a80b77524b4c91c5772dfef097a8a52
2 files changed
+17
-1
src/libnetdata/socket/connect-to.c
+8
@@ -229,6 +229,14 @@ int connect_to_this_ip46(
229
// PORT = port number or service name
230
231
int connect_to_this(const char *definition, int default_port, struct timeval *timeout) {
232
+ if(!definition || !*definition) {
233
+ nd_log(NDLS_DAEMON, NDLP_ERR,
234
+ "Definition '%s' does not specify a host.",
235
+ definition ? definition : "(null)");
236
+
237
+ return -ND_SOCK_ERR_NO_HOST_IN_DEFINITION;
238
+ }
239
+
240
char buffer[strlen(definition) + 1];
241
strcpy(buffer, definition);
242
src/libnetdata/socket/nd-sock.c
+9
-1
@@ -64,10 +64,18 @@ static bool nd_sock_open_ssl(ND_SOCK *s) {
64
}
65
66
bool nd_sock_connect_to_this(ND_SOCK *s, const char *definition, int default_port, time_t timeout, bool ssl) {
67
+ if(!s)
68
+ return false;
69
+
70
nd_sock_close(s);
71
72
+ if(!definition || !*definition) {
73
+ s->error = ND_SOCK_ERR_NO_HOST_IN_DEFINITION;
74
+ return false;
75
+ }
76
+
77
// Extract hostname for SNI before establishing connection
70
- if(ssl && definition) {
78
+ if(ssl) {
79
char buffer[strlen(definition) + 1];
80
strcpy(buffer, definition);
81