[enricolorenzoni59]

Summary
serviceListen() declares int newfds[16] and passes sizeof (newfds) to anetTcpServer() as the maximum number of descriptors it may store. That argument is a count, not a size: it is 64. If getaddrinfo() returns more than 16 addresses for which bind() succeeds, the loop in anetTcpServer() writes up to 64 ints into the 16-int stack array.

Impact
--net-bind-address is passed to getaddrinfo() as the node name, so any hostname is accepted (the help text says <ipaddr>, nothing validates it). A name with more than 16 addresses overflows newfds by up to 192 bytes on the stack while the network services are initialized. The overflow stops when bind() fails, so it needs a hostname with many bindable addresses; with one it is a remote-ish configuration crash/corruption, not a theoretical one.

Repro
With an interposer that returns 20 addresses for many.example (DYLD_INTERPOSE on macOS, LD_PRELOAD on Linux; each entry on its own port so every bind() succeeds):

$ DYLD_INSERT_LIBRARIES=manyaddrs.dylib ./readsb --net-only --net --quiet \
    --net-bind-address many.example --net-bi-port 39123
==43596==ERROR: AddressSanitizer: stack-buffer-overflow
WRITE of size 4 at 0x00016f27dd20 thread T2
    #0 anetListen anet.c:385
    #1 anetTcpServer anet.c:381
    #2 serviceListen net_io.c:836
    #3 modesInitNet net_io.c:1095
SUMMARY: AddressSanitizer: stack-buffer-overflow anet.c:385 in anetListen

Fix
Pass the array capacity, sizeof (newfds) / sizeof (newfds[0]), instead of the array size in bytes. The listener then uses at most the first 16 addresses, as intended.

Verification

• Before: ASan aborts with a stack-buffer-overflow in anetTcpServer() called from serviceListen().
• After: no sanitizer report, 39123: Beast TCP input port is printed and readsb runs normally (exits cleanly with --auto-exit).
• Normal builds and plain IP addresses are unaffected: the count only bounds the loop, the first 16 entries are used as before.

[wiedehopf]

And it only allows 16 addresses?!
Let's do 64 it I don't see any drawback haha :)

[enricolorenzoni59]

Probably 16 are enough, if not: #200

[wiedehopf]

already changed a bit of code around, that really doesn't need a PR ;p