Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1411391 > unrolled thread
| Started by | Kangjie Lu <kangjielu@gmail.com> |
|---|---|
| First post | 2016-06-01 18:40 +0200 |
| Last post | 2016-06-02 08:40 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH] tipc: fix an infoleak in tipc_nl_compat_link_dump Kangjie Lu <kangjielu@gmail.com> - 2016-06-01 18:40 +0200
Re: [PATCH] tipc: fix an infoleak in tipc_nl_compat_link_dump David Miller <davem@davemloft.net> - 2016-06-02 08:40 +0200
| From | Kangjie Lu <kangjielu@gmail.com> |
|---|---|
| Date | 2016-06-01 18:40 +0200 |
| Subject | [PATCH] tipc: fix an infoleak in tipc_nl_compat_link_dump |
| Message-ID | <rFhlz-2kH-111@gated-at.bofh.it> |
link_info.str is a char array of size 60. Memory after the NULL byte is not initialized. Sending the whole object out can cause a leak. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> --- net/tipc/netlink_compat.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index f795b1d..115aafa 100644 --- a/net/tipc/netlink_compat.c +++ b/net/tipc/netlink_compat.c @@ -604,6 +604,7 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg, link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]); link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP])); + memset((void *)link_info.str, 0, TIPC_MAX_LINK_NAME); strcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME])); return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO, -- 2.7.4
[toc] | [next] | [standalone]
| From | David Miller <davem@davemloft.net> |
|---|---|
| Date | 2016-06-02 08:40 +0200 |
| Message-ID | <rFusq-2oO-45@gated-at.bofh.it> |
| In reply to | #1411391 |
From: Kangjie Lu <kangjielu@gmail.com> Date: Wed, 1 Jun 2016 12:34:55 -0400 > diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c > index f795b1d..115aafa 100644 > --- a/net/tipc/netlink_compat.c > +++ b/net/tipc/netlink_compat.c > @@ -604,6 +604,7 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg, > > link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]); > link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP])); > + memset((void *)link_info.str, 0, TIPC_MAX_LINK_NAME); > strcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME])); > Please instead use "nla_strlcpy()". Thanks.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web