From a9640bad1a75997db85ec7cbd0d06c9a0049e68a Mon Sep 17 00:00:00 2001
From: liqinhui <liqinhui@xiaomi.com>
Date: Mon, 27 Mar 2023 14:45:23 +0800
Subject: [PATCH] net: Add the check that socket domain is equal to bound
 address type, when do bind.

When do socket bind, if the connection domain is not equal to the bound address type, this will cause the stack-buffer-overflow.

Signed-off-by: liqinhui <liqinhui@xiaomi.com>
---
 net/tcp/tcp_conn.c | 9 +++++++++
 net/udp/udp_conn.c | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/net/tcp/tcp_conn.c b/net/tcp/tcp_conn.c
index e95f2a4ab75..b421d9d4536 100644
--- a/net/tcp/tcp_conn.c
+++ b/net/tcp/tcp_conn.c
@@ -1199,6 +1199,15 @@ FAR struct tcp_conn_s *tcp_alloc_accept(FAR struct net_driver_s *dev,
 
 int tcp_bind(FAR struct tcp_conn_s *conn, FAR const struct sockaddr *addr)
 {
+#if defined(CONFIG_NET_IPv4) && defined(CONFIG_NET_IPv6)
+  if (conn->domain != addr->sa_family)
+    {
+      nerr("ERROR: Invalid address type: %d != %d\n", conn->domain,
+           addr->sa_family);
+      return -EINVAL;
+    }
+#endif
+
 #ifdef CONFIG_NET_IPv4
 #ifdef CONFIG_NET_IPv6
   if (conn->domain == PF_INET)
diff --git a/net/udp/udp_conn.c b/net/udp/udp_conn.c
index 5b180649277..7c2a631896d 100644
--- a/net/udp/udp_conn.c
+++ b/net/udp/udp_conn.c
@@ -807,6 +807,15 @@ int udp_bind(FAR struct udp_conn_s *conn, FAR const struct sockaddr *addr)
   uint16_t portno;
   int ret;
 
+#if defined(CONFIG_NET_IPv4) && defined(CONFIG_NET_IPv6)
+  if (conn->domain != addr->sa_family)
+    {
+      nerr("ERROR: Invalid address type: %d != %d\n", conn->domain,
+           addr->sa_family);
+      return -EINVAL;
+    }
+#endif
+
 #ifdef CONFIG_NET_IPv4
 #ifdef CONFIG_NET_IPv6
   if (conn->domain == PF_INET)