Patchwork [1/4] batman-adv: check proto length before accessing proto string buffer

login
register
mail settings
Submitter Antonio Quartulli
Date May 9, 2013, 10:56 a.m.
Message ID <1368097007-817-2-git-send-email-ordex@autistici.org>
Download mbox | patch
Permalink /patch/242751/
State Accepted
Delegated to: David Miller
Headers show

Comments

Antonio Quartulli - May 9, 2013, 10:56 a.m.
From: Marek Lindner <lindner_marek@yahoo.de>

batadv_param_set_ra() strips the trailing '\n' from the supplied
string buffer without checking the length of the buffer first. This
patches avoids random memory access and associated potential
crashes.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
---
 net/batman-adv/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch

diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 3e30a0f..9c620cd 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -475,7 +475,7 @@  static int batadv_param_set_ra(const char *val, const struct kernel_param *kp)
 	char *algo_name = (char *)val;
 	size_t name_len = strlen(algo_name);
 
-	if (algo_name[name_len - 1] == '\n')
+	if (name_len > 0 && algo_name[name_len - 1] == '\n')
 		algo_name[name_len - 1] = '\0';
 
 	bat_algo_ops = batadv_algo_get(algo_name);