netdev - Re: [Fwd: Bug#488430: iproute: lnstat causes segmentation fault]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <1214850041.16171.53.camel@amd64.fatal.se>
Date:	Mon, 30 Jun 2008 20:20:41 +0200
From:	Andreas Henriksson <andreas@...al.se>
To:	Stephen Hemminger <shemminger@...tta.com>
Cc:	netdev@...r.kernel.org, Andrew France <andrew@...to.co.uk>,
	488430@...s.debian.org
Subject: Re: [Fwd: Bug#488430: iproute: lnstat causes segmentation fault]

On mån, 2008-06-30 at 10:36 -0700, Stephen Hemminger wrote:
> The problem is that MAX_FIELDS is 64, but lnstat is finding 71 fields.
> This causes a array out of range problem.
> 
> Just bump MAX_FIELDS to 128

Oh, stupid me to not catch that when I was thinking it used un-allocated
memory and all...
Here's a patch that prevents the overflow and throws a warning instead.


diff --git a/misc/lnstat.c b/misc/lnstat.c
index b56598a..5a0c349 100644
--- a/misc/lnstat.c
+++ b/misc/lnstat.c
@@ -121,6 +121,10 @@ static int map_field_params(struct lnstat_file *lnstat_files,
 				if (!fps->params[j].print.width)
 					fps->params[j].print.width =
 							FIELD_WIDTH_DEFAULT;
+				if (j >= MAX_FIELDS) {
+					fprintf(stderr, "WARN: MAX_FIELDS (%d) reached, truncating input data.\n", MAX_FIELDS);
+					break;
+				}
 				j++;
 			}
 		}
@@ -269,8 +273,10 @@ int main(int argc, char **argv)
 				for (tok = strtok(tmp, ",");
 				     tok;
 				     tok = strtok(NULL, ",")) {
-					if (fp.num >= MAX_FIELDS)
+					if (fp.num >= MAX_FIELDS) {
+						fprintf(stderr, "WARN: MAX_FIELDS (%d) reached, truncating given keys.\n", MAX_FIELDS);
 						break;
+					}
 					fp.params[fp.num++].name = tok;
 				}
 				break;

-- 
Regards,
Andreas Henriksson
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html