Commit f53ecee8 authored by Phil Sutter's avatar Phil Sutter Committed by Stephen Hemminger

iptunnel: sanitize copying tunnel name

Since p->name is only IFNAMSIZ bytes, do not copy more than IFNAMSIZ - 1
bytes into it so there remains at least a single null byte in the end.
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
parent c957821b
...@@ -175,7 +175,7 @@ static int parse_args(int argc, char **argv, int cmd, struct ip_tunnel_parm *p) ...@@ -175,7 +175,7 @@ static int parse_args(int argc, char **argv, int cmd, struct ip_tunnel_parm *p)
usage(); usage();
if (p->name[0]) if (p->name[0])
duparg2("name", *argv); duparg2("name", *argv);
strncpy(p->name, *argv, IFNAMSIZ); strncpy(p->name, *argv, IFNAMSIZ - 1);
if (cmd == SIOCCHGTUNNEL && count == 0) { if (cmd == SIOCCHGTUNNEL && count == 0) {
struct ip_tunnel_parm old_p; struct ip_tunnel_parm old_p;
memset(&old_p, 0, sizeof(old_p)); memset(&old_p, 0, sizeof(old_p));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment