matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

tc util: Fix possible buffer overflow when print class id 

Use correct handle buffer length.

Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
This commit is contained in:
Vadim Kochan 2015-04-20 08:33:32 +03:00 committed by Stephen Hemminger
parent 782cf01dc0
commit 46679bbbe8
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
tc/tc_util.c
View File

@ -128,30 +128,31 @@ ok:
return 0; return 0;
} }
int print_tc_classid(char *buf, int len, __u32 h) int print_tc_classid(char *buf, int blen, __u32 h)
{ {
char handle[40] = {}; SPRINT_BUF(handle) = {};
int hlen = SPRINT_BSIZE - 1;
if (h == TC_H_ROOT) if (h == TC_H_ROOT)
sprintf(handle, "root"); sprintf(handle, "root");
else if (h == TC_H_UNSPEC) else if (h == TC_H_UNSPEC)
snprintf(handle, len, "none"); snprintf(handle, hlen, "none");
else if (TC_H_MAJ(h) == 0) else if (TC_H_MAJ(h) == 0)
snprintf(handle, len, ":%x", TC_H_MIN(h)); snprintf(handle, hlen, ":%x", TC_H_MIN(h));
else if (TC_H_MIN(h) == 0) else if (TC_H_MIN(h) == 0)
snprintf(handle, len, "%x:", TC_H_MAJ(h) >> 16); snprintf(handle, hlen, "%x:", TC_H_MAJ(h) >> 16);
else else
snprintf(handle, len, "%x:%x", TC_H_MAJ(h) >> 16, TC_H_MIN(h)); snprintf(handle, hlen, "%x:%x", TC_H_MAJ(h) >> 16, TC_H_MIN(h));
if (use_names) { if (use_names) {
char clname[IDNAME_MAX] = {}; char clname[IDNAME_MAX] = {};
if (id_to_name(cls_names, h, clname)) if (id_to_name(cls_names, h, clname))
snprintf(buf, len, "%s#%s", clname, handle); snprintf(buf, blen, "%s#%s", clname, handle);
else else
snprintf(buf, len, "%s", handle); snprintf(buf, blen, "%s", handle);
} else { } else {
snprintf(buf, len, "%s", handle); snprintf(buf, blen, "%s", handle);
} }
return 0; return 0;