diff mbox

[iproute] tc: don't accept qdisc 'handle' greater than ffff

Message ID bdc0d8e58be9344b44fcd64a56b5b62004c108a1.1473930575.git.dcaratti@redhat.com
State Accepted, archived
Delegated to: stephen hemminger
Headers show

Commit Message

Davide Caratti Sept. 16, 2016, 8:30 a.m. UTC
since get_qdisc_handle() truncates the input value to 16 bit, return an
error and prompt "invalid qdisc ID" in case input 'handle' parameter needs
more than 16 bit to be stored.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
 tc/tc_util.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Phil Sutter Sept. 18, 2016, 7:47 p.m. UTC | #1
On Fri, Sep 16, 2016 at 10:30:00AM +0200, Davide Caratti wrote:
> since get_qdisc_handle() truncates the input value to 16 bit, return an
> error and prompt "invalid qdisc ID" in case input 'handle' parameter needs
> more than 16 bit to be stored.
> 
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Acked-by: Phil Sutter <phil@nwl.cc>
Stephen Hemminger Sept. 20, 2016, 4:46 p.m. UTC | #2
On Fri, 16 Sep 2016 10:30:00 +0200
Davide Caratti <dcaratti@redhat.com> wrote:

> since get_qdisc_handle() truncates the input value to 16 bit, return an
> error and prompt "invalid qdisc ID" in case input 'handle' parameter needs
> more than 16 bit to be stored.
> 
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Applied
diff mbox

Patch

diff --git a/tc/tc_util.c b/tc/tc_util.c
index 15e49b7..24ca1f1 100644
--- a/tc/tc_util.c
+++ b/tc/tc_util.c
@@ -82,7 +82,7 @@  int get_qdisc_handle(__u32 *h, const char *str)
 	if (strcmp(str, "none") == 0)
 		goto ok;
 	maj = strtoul(str, &p, 16);
-	if (p == str)
+	if (p == str || maj >= (1 << 16))
 		return -1;
 	maj <<= 16;
 	if (*p != ':' && *p != 0)