matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

iptunnel: sanitize copying tunnel name 

Since p->name is only IFNAMSIZ bytes, do not copy more than IFNAMSIZ - 1
bytes into it so there remains at least a single null byte in the end.

Signed-off-by: Phil Sutter <phil@nwl.cc>
This commit is contained in:
Phil Sutter 2015-11-13 18:09:04 +01:00 committed by Stephen Hemminger
parent c957821b18
commit f53ecee818
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ip/iptunnel.c
View File

@ -175,7 +175,7 @@ static int parse_args(int argc, char **argv, int cmd, struct ip_tunnel_parm *p)
usage(); usage();
if (p->name[0]) if (p->name[0])
duparg2("name", *argv); duparg2("name", *argv);
strncpy(p->name, *argv, IFNAMSIZ); strncpy(p->name, *argv, IFNAMSIZ - 1);
if (cmd == SIOCCHGTUNNEL && count == 0) { if (cmd == SIOCCHGTUNNEL && count == 0) {
struct ip_tunnel_parm old_p; struct ip_tunnel_parm old_p;
memset(&old_p, 0, sizeof(old_p)); memset(&old_p, 0, sizeof(old_p));