matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ip maddr show” on an infiniband address causes a stack corruption 

“ip maddr show” on an infiniband address causes a stack corruption
because the length of the address for Infiniband (20 bytes, as
described in kernel doc Documentation/infiniband/ipoib.txt) does not
fit on the 16 bytes of the field in which it gets stored.

The proposed patch increases the size of the hardware address from 4
__u32 to 8 and also adds a check to avoid overriding the available
size while parsing the hardware address.

This bug affects current upstream code AFAICT.

Hope this helps,
Cheers,
Olivier.

“ip maddr show ib0” causes a stack corruption because the length of the address
for Infiniband (20 see kernel doc Documentation/infiniband/ipoib.txt) does not
fit on the 16 bytes of the field in which it gets stored.

The proposed patch increases the size of the hardware address from 4 u32 to 8
and adds a check to avoid overriding the available size while parsing the
hardware address.
This commit is contained in:
Olivier Fourdan 2008-11-25 12:36:22 +00:00 committed by Stephen Hemminger
parent 72c771b20e
commit 7f71c0cae2
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/utils.h
View File

@ -46,7 +46,7 @@ typedef struct
__u8 bytelen; __u8 bytelen;
__s16 bitlen; __s16 bitlen;
__u32 flags; __u32 flags;
__u32 data[4]; __u32 data[8];
} inet_prefix; } inet_prefix;
#define PREFIXLEN_SPECIFIED 1 #define PREFIXLEN_SPECIFIED 1

8
ip/ipmaddr.c
View File

@ -43,11 +43,11 @@ static void usage(void)
exit(-1); exit(-1);
} }
static int parse_hex(char *str, unsigned char *addr) static int parse_hex(char *str, unsigned char *addr, size_t size)
{ {
int len=0; int len=0;
while (*str) { while (*str && (len < 2 * size)) {
int tmp; int tmp;
if (str[1] == 0) if (str[1] == 0)
return -1; return -1;
@ -104,7 +104,7 @@ void read_dev_mcast(struct ma_info **result_p)
m.addr.family = AF_PACKET; m.addr.family = AF_PACKET;
len = parse_hex(hexa, (unsigned char*)&m.addr.data); len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof (m.addr.data));
if (len >= 0) { if (len >= 0) {
struct ma_info *ma = malloc(sizeof(m)); struct ma_info *ma = malloc(sizeof(m));
@ -176,7 +176,7 @@ void read_igmp6(struct ma_info **result_p)
m.addr.family = AF_INET6; m.addr.family = AF_INET6;
len = parse_hex(hexa, (unsigned char*)&m.addr.data); len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof (m.addr.data));
if (len >= 0) { if (len >= 0) {
struct ma_info *ma = malloc(sizeof(m)); struct ma_info *ma = malloc(sizeof(m));