netdev - [PATCH iproute2] ipaddress: strengthen check on 'label' input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1524578901-28278-1-git-send-email-ptalbert@redhat.com>
Date:   Tue, 24 Apr 2018 16:08:21 +0200
From:   Patrick Talbert <ptalbert@...hat.com>
To:     netdev@...r.kernel.org
Cc:     stephen@...workplumber.org
Subject: [PATCH iproute2] ipaddress: strengthen check on 'label' input

As mentioned in the ip-address man page, an address label must
be equal to the device name or prefixed by the device name
followed by a colon. Currently the only check on this input is
to see if the device name appears at the beginning of the label
string.

This commit adds an additional check to ensure label == dev or
continues with a colon.

Signed-off-by: Patrick Talbert <ptalbert@...hat.com>
---
 ip/ipaddress.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/ip/ipaddress.c b/ip/ipaddress.c
index aecc9a1..edcf821 100644
--- a/ip/ipaddress.c
+++ b/ip/ipaddress.c
@@ -2168,9 +2168,14 @@ static int ipaddr_modify(int cmd, int flags, int argc, char **argv)
 		fprintf(stderr, "Not enough information: \"dev\" argument is required.\n");
 		return -1;
 	}
-	if (l && matches(d, l) != 0) {
-		fprintf(stderr, "\"dev\" (%s) must match \"label\" (%s).\n", d, l);
-		return -1;
+	if (l) {
+		size_t d_len = strlen(d);
+
+		if (!(matches(d, l) == 0 && (l[d_len] == '\0' || l[d_len] == ':'))) {
+			fprintf(stderr, "\"label\" (%s) must match \"dev\" (%s) or be prefixed by"
+				" \"dev\" with a colon.\n", l, d);
+			return -1;
+		}
 	}
 
 	if (peer_len == 0 && local_len) {
-- 
1.8.3.1