Patchwork Bug#526329: iproute: Segfault on garbage lladdr

login
register
mail settings
Submitter Andreas Henriksson
Date April 30, 2009, 2:50 p.m.
Message ID <1241103050.19807.34.camel@amd64.fatal.se>
Download mbox | patch
Permalink /patch/26696/
State Not Applicable
Delegated to: David Miller
Headers show

Comments

Andreas Henriksson - April 30, 2009, 2:50 p.m.
On tor, 2009-04-30 at 14:32 +0100, Timothy Baldwin wrote:
> Package: iproute
> Version: 20090324-1
> Severity: minor
> 
> 
> $ ip link set eth0 address help
> "help" is invalid lladdr.
> Segmentation fault
> 
> Desipte the invalid command line arguments it shouldn't crash.
> 

Callers need to check return value from ll_addr_a2n(). Patch below.

Signed-off-by: Andreas Henriksson <andreas@fatal.se>



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/ip/iplink.c b/ip/iplink.c
index 237ea82..55558e3 100644
--- a/ip/iplink.c
+++ b/ip/iplink.c
@@ -200,11 +200,15 @@  int iplink_parse(int argc, char **argv, struct iplink_req *req,
 		} else if (matches(*argv, "address") == 0) {
 			NEXT_ARG();
 			len = ll_addr_a2n(abuf, sizeof(abuf), *argv);
+			if (len < 0)
+				return -1;
 			addattr_l(&req->n, sizeof(*req), IFLA_ADDRESS, abuf, len);
 		} else if (matches(*argv, "broadcast") == 0 ||
 				strcmp(*argv, "brd") == 0) {
 			NEXT_ARG();
 			len = ll_addr_a2n(abuf, sizeof(abuf), *argv);
+			if (len < 0)
+				return -1;
 			addattr_l(&req->n, sizeof(*req), IFLA_BROADCAST, abuf, len);
 		} else if (matches(*argv, "txqueuelen") == 0 ||
 				strcmp(*argv, "qlen") == 0 ||