lkml.org 
[lkml]   [2023]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] tipc: Fix uninit-value access in tipc_nl_node_get_link()
Date
Names must be null-terminated strings. If a name which is not 
null-terminated is passed through netlink, strstr() and similar
functions can cause buffer overrun. This patch fixes this issue
by returning -EINVAL if a non-null-terminated name is passed.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
---
net/tipc/node.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 3105abe97bb9..a02bcd7e07d3 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -2519,6 +2519,9 @@ int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info)
return -EINVAL;

name = nla_data(attrs[TIPC_NLA_LINK_NAME]);
+ if (name[strnlen(name,
+ nla_len(attrs[TIPC_NLA_LINK_NAME]))] != '\0')
+ return -EINVAL;

msg.skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
if (!msg.skb)
--
2.37.2
\
 
 \ /
  Last update: 2023-10-13 09:06    [W:0.076 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site