OpenWRT
/
luci
mirror of https://github.com/openwrt/luci.git
1
0
Fork 0
Code Issues Releases Wiki Activity

luci-lib-ip: fix segfault in link() on systems with ip6gre support 

If an ip6gre interface is queried, the resulting link local address string
of 47 byte overflowed the buffer of 32 bytes used to hold the translated
address.

Increase the address string buffer to 48 byte and check the address length
prior to writing it into the buffer to avoid future problems with longs
link local addresses.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
pull/316/head
Jo-Philipp Wich 2015-01-25 21:39:17 +01:00
parent 5317b09be7
commit 0d32e69f16
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libs/luci-lib-ip/src/ip.c
View File

@ -1197,12 +1197,12 @@ out:
static int cb_dump_link(struct nl_msg *msg, void *arg)
{
char *p, *addr, buf[32];
char *p, *addr, buf[48];
struct dump_state *s = arg;
struct nlmsghdr *hdr = nlmsg_hdr(msg);
struct ifinfomsg *ifm = NLMSG_DATA(hdr);
struct nlattr *tb[IFLA_MAX+1];
int i;
int i, len;
if (hdr->nlmsg_type != RTM_NEWLINK)
return NL_SKIP;
@ -1224,12 +1224,16 @@ static int cb_dump_link(struct nl_msg *msg, void *arg)
if (tb[IFLA_ADDRESS])
{
len = nla_len(tb[IFLA_ADDRESS]);
addr = nla_get_string(tb[IFLA_ADDRESS]);
for (p = buf, i = 0; i < nla_len(tb[IFLA_ADDRESS]); i++)
p += sprintf(p, "%s%02x", (i ? ":" : ""), (uint8_t)*addr++);
if ((len * 3) <= sizeof(buf))
{
for (p = buf, i = 0; i < len; i++)
p += sprintf(p, "%s%02x", (i ? ":" : ""), (uint8_t)*addr++);
L_setstr(s->L, "mac", buf);
L_setstr(s->L, "mac", buf);
}
}
s->pending = 0;