netdev - [PATCH] Truncate MCAST_GRP_NAME and FAMILY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1363696029-12559-1-git-send-email-yamato@redhat.com>
Date:	Tue, 19 Mar 2013 21:27:09 +0900
From:	Masatake YAMATO <yamato@...hat.com>
To:	netdev@...r.kernel.org
Cc:	Masatake YAMATO <yamato@...hat.com>
Subject: [PATCH] Truncate MCAST_GRP_NAME and FAMILY_NAME char arrays as C strings

This is a patch for genl command in iproute2.

You will see garbage at the end of line in the output of following command line:

	$ genl ctrl show | grep thermal_mc_group
        #1:  ID-0x2  name: thermal_mc_group^B

The type of structure field for "name" is char[16] in kernel:

    #define GENL_NAMSIZ	16	/* length of family name */
    ...
    struct genl_multicast_group {
            ...
	    char		name[GENL_NAMSIZ];
            ...
    };

strlen("thermal_mc_group") == 16 is too long for the array size.

This patch protects genl process from this kind of bug by putting
nul char at the end of array after receiving a message from the
kernel.

Signed-off-by: Masatake YAMATO <yamato@...hat.com>
---
 genl/ctrl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/genl/ctrl.c b/genl/ctrl.c
index 7c42578..fd5a50a 100644
--- a/genl/ctrl.c
+++ b/genl/ctrl.c
@@ -168,6 +168,7 @@ static int print_ctrl_grp(FILE *fp, struct rtattr *arg, __u32 ctrl_ver)
 	}
 	if (tb[1]) {
 		char *name = RTA_DATA(tb[CTRL_ATTR_MCAST_GRP_NAME]);
+		name[GENL_NAMSIZ - 1] = '\0';
 		fprintf(fp, " name: %s ", name);
 	}
 	return 0;
@@ -214,6 +215,7 @@ static int print_ctrl(const struct sockaddr_nl *who, struct nlmsghdr *n,
 
 	if (tb[CTRL_ATTR_FAMILY_NAME]) {
 		char *name = RTA_DATA(tb[CTRL_ATTR_FAMILY_NAME]);
+		name[GENL_NAMSIZ - 1] = '\0';
 		fprintf(fp, "\nName: %s\n",name);
 	}
 	if (tb[CTRL_ATTR_FAMILY_ID]) {
-- 
1.7.11.7

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html