diff options
| author | Dimitri Staessens <[email protected]> | 2018-10-09 21:02:14 +0200 |
|---|---|---|
| committer | Sander Vrijders <[email protected]> | 2018-10-10 09:07:13 +0200 |
| commit | e8b3e880da69f9ac398bfd90015564ef09e948a3 (patch) | |
| tree | e088904f6bedfb04581f4db7a51a2a352fd8bc93 /src/ipcpd/eth | |
| parent | ee1e7fe6c4d101569d045bcc8b99d7f0779f7e96 (diff) | |
| download | ouroboros-e8b3e880da69f9ac398bfd90015564ef09e948a3.tar.gz ouroboros-e8b3e880da69f9ac398bfd90015564ef09e948a3.zip | |
ipcpd: Fix SEGV in eth IPCP
The memcpy of the device name was copying a fixed set of bytes
(IFNAMSIZ), but the string conf->dev is usually shorter.
Signed-off-by: Dimitri Staessens <[email protected]>
Signed-off-by: Sander Vrijders <[email protected]>
Diffstat (limited to 'src/ipcpd/eth')
| -rw-r--r-- | src/ipcpd/eth/eth.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/ipcpd/eth/eth.c b/src/ipcpd/eth/eth.c index 1bbfac5b..e7a1580c 100644 --- a/src/ipcpd/eth/eth.c +++ b/src/ipcpd/eth/eth.c @@ -1242,8 +1242,13 @@ static int eth_ipcp_bootstrap(const struct ipcp_config * conf) return -1; } + if (strlen(conf->dev) >= IFNAMSIZ) { + log_err("Invalid device name: %s.", conf->dev); + return -1; + } + memset(&ifr, 0, sizeof(ifr)); - memcpy(ifr.ifr_name, conf->dev, IFNAMSIZ); + strcpy(ifr.ifr_name, conf->dev); #ifdef BUILD_ETH_DIX if (conf->ethertype < 0x0600 || conf->ethertype == 0xFFFF) { |