listen: ip bind: fix numeric iface parse overrunning caller sockaddr_in

[saghul]

lws_interface_to_sa() may be handed a buffer as small as a struct
sockaddr_in: lws_socket_bind()'s AF_INET path passes its 16-byte
serv_addr4 (with addrlen = sizeof(serv_addr4)). When ifname is not a
real interface name, the fallback casts that buffer to lws_sockaddr46 *
and calls lws_sa46_parse_numeric_address(), which begins with

memset(sa46, 0, sizeof(*sa46));

sizeof(lws_sockaddr46) is 28 bytes when IPv6 is enabled (it embeds a
struct sockaddr_in6), so this writes 12 bytes past a 16-byte caller
buffer. ASan reports a stack-buffer-overflow in
lws_sa46_parse_numeric_address() for any listen bind to a numeric IPv4
address (eg, lws_socket_bind() -> lws_interface_to_sa() with iface
"127.0.0.1"); in a release build the overrun silently clobbers adjacent
stack.

addrlen is already passed for exactly this reason but was ignored on
this path. Parse into a local full-width lws_sockaddr46 and memcpy back
only min(sa46_socklen(), addrlen) bytes, so the caller's buffer is never
overrun regardless of family.

The 28-byte memset was introduced with the recent
lws_sa46_parse_numeric_address() rework; the (lws_sockaddr46 *)addr cast
predates it and was harmless while the function only wrote the parsed
family's fields.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud