Possible buffer overruns in l9p_start_server

[kimshrier]

The arrays kev, event, and sockets, are allocated with a fixed size of 2. These arrays are populated with values derived from the result list returned from getaddrinfo. It is possible for getaddrinfo to return more than 2 addrinfo values in its return list. In the event that it does and that sockets are successfully created from each one, the sockets array would be overrun. In the following code that sets up event handlers for these sockets, the kev and event arrays would be overrun as well.

There are 2 ways to fix the problem. Either limit the for loop that runs the addrinfo list to 2, or malloc the kev, event, and sockets arrays based on the number of entries in the return list. In the case of limiting the for loop, I would make a define for the number of entries in these arrays and use the same defined value in the for loop. Something like:

#define MAXSOCK 2

...

struct kevent kev[MAXSOCK];
struct kevent event[MAXSOCK];
int sockets[MAXSOCK];

...

for (res = res0; res && nsockets < MAXSOCK; res = res->ai_next) {

I can submit a pull request for either solution.