diff options
| author | Olivier Fourdan <ofourdan@redhat.com> | 2008-11-25 12:36:22 +0000 |
|---|---|---|
| committer | Stephen Hemminger <stephen.hemminger@vyatta.com> | 2009-01-06 18:56:03 -0800 |
| commit | 7f71c0cae2db61890474e04ba3a26e40219e5561 (patch) | |
| tree | 350621134d5fac23b27e961d146c2577959c5d49 /ip/ipmaddr.c | |
| parent | 72c771b20e38eaabb7699625fcdc144a51771f9c (diff) | |
ip maddr show” on an infiniband address causes a stack corruption
“ip maddr show” on an infiniband address causes a stack corruption
because the length of the address for Infiniband (20 bytes, as
described in kernel doc Documentation/infiniband/ipoib.txt) does not
fit on the 16 bytes of the field in which it gets stored.
The proposed patch increases the size of the hardware address from 4
__u32 to 8 and also adds a check to avoid overriding the available
size while parsing the hardware address.
This bug affects current upstream code AFAICT.
Hope this helps,
Cheers,
Olivier.
“ip maddr show ib0” causes a stack corruption because the length of the address
for Infiniband (20 see kernel doc Documentation/infiniband/ipoib.txt) does not
fit on the 16 bytes of the field in which it gets stored.
The proposed patch increases the size of the hardware address from 4 u32 to 8
and adds a check to avoid overriding the available size while parsing the
hardware address.
Diffstat (limited to 'ip/ipmaddr.c')
| -rw-r--r-- | ip/ipmaddr.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/ip/ipmaddr.c b/ip/ipmaddr.c index 1014f832..44ffdfcf 100644 --- a/ip/ipmaddr.c +++ b/ip/ipmaddr.c @@ -43,11 +43,11 @@ static void usage(void) exit(-1); } -static int parse_hex(char *str, unsigned char *addr) +static int parse_hex(char *str, unsigned char *addr, size_t size) { int len=0; - while (*str) { + while (*str && (len < 2 * size)) { int tmp; if (str[1] == 0) return -1; @@ -104,7 +104,7 @@ void read_dev_mcast(struct ma_info **result_p) m.addr.family = AF_PACKET; - len = parse_hex(hexa, (unsigned char*)&m.addr.data); + len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof (m.addr.data)); if (len >= 0) { struct ma_info *ma = malloc(sizeof(m)); @@ -176,7 +176,7 @@ void read_igmp6(struct ma_info **result_p) m.addr.family = AF_INET6; - len = parse_hex(hexa, (unsigned char*)&m.addr.data); + len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof (m.addr.data)); if (len >= 0) { struct ma_info *ma = malloc(sizeof(m)); |