summaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2015-01-25 21:39:17 +0100
committerJo-Philipp Wich <jow@openwrt.org>2015-01-25 21:39:17 +0100
commit0d32e69f163e80442c7a483c445484ee250986e8 (patch)
treede0c4d4c9b5cd5d85f564a4995b381e4ece58301
parent5317b09be7304cb816b2643fc2cdd52f6f5bbdac (diff)
luci-lib-ip: fix segfault in link() on systems with ip6gre support
If an ip6gre interface is queried, the resulting link local address string of 47 byte overflowed the buffer of 32 bytes used to hold the translated address. Increase the address string buffer to 48 byte and check the address length prior to writing it into the buffer to avoid future problems with longs link local addresses. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
-rw-r--r--libs/luci-lib-ip/src/ip.c14
1 files changed, 9 insertions, 5 deletions
diff --git a/libs/luci-lib-ip/src/ip.c b/libs/luci-lib-ip/src/ip.c
index 5bff693f62..760506a9ee 100644
--- a/libs/luci-lib-ip/src/ip.c
+++ b/libs/luci-lib-ip/src/ip.c
@@ -1197,12 +1197,12 @@ out:
static int cb_dump_link(struct nl_msg *msg, void *arg)
{
- char *p, *addr, buf[32];
+ char *p, *addr, buf[48];
struct dump_state *s = arg;
struct nlmsghdr *hdr = nlmsg_hdr(msg);
struct ifinfomsg *ifm = NLMSG_DATA(hdr);
struct nlattr *tb[IFLA_MAX+1];
- int i;
+ int i, len;
if (hdr->nlmsg_type != RTM_NEWLINK)
return NL_SKIP;
@@ -1224,12 +1224,16 @@ static int cb_dump_link(struct nl_msg *msg, void *arg)
if (tb[IFLA_ADDRESS])
{
+ len = nla_len(tb[IFLA_ADDRESS]);
addr = nla_get_string(tb[IFLA_ADDRESS]);
- for (p = buf, i = 0; i < nla_len(tb[IFLA_ADDRESS]); i++)
- p += sprintf(p, "%s%02x", (i ? ":" : ""), (uint8_t)*addr++);
+ if ((len * 3) <= sizeof(buf))
+ {
+ for (p = buf, i = 0; i < len; i++)
+ p += sprintf(p, "%s%02x", (i ? ":" : ""), (uint8_t)*addr++);
- L_setstr(s->L, "mac", buf);
+ L_setstr(s->L, "mac", buf);
+ }
}
s->pending = 0;