jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Verify that readlink() did not truncate result

Browse source 
linux_br_get() was forcing null termination on the buffer, but did not
check whether the string could have been truncated. Make this more
strict by rejecting any truncation case.

Signed-hostap: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2013-10-26 12:25:20 +03:00
parent f5eb9da304
commit 0f0120148a
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/drivers/linux_ioctl.c
View file

@ -204,11 +204,14 @@ int linux_br_del_if(int sock, const char *brname, const char *ifname)
int linux_br_get(char *brname, const char *ifname) int linux_br_get(char *brname, const char *ifname)
{ {
char path[128], brlink[128], *pos; char path[128], brlink[128], *pos;
ssize_t res;
os_snprintf(path, sizeof(path), "/sys/class/net/%s/brport/bridge", os_snprintf(path, sizeof(path), "/sys/class/net/%s/brport/bridge",
ifname); ifname);
os_memset(brlink, 0, sizeof(brlink)); res = readlink(path, brlink, sizeof(brlink));
if (readlink(path, brlink, sizeof(brlink) - 1) < 0) if (res < 0 || (size_t) res >= sizeof(brlink))
return -1; return -1;
brlink[res] = '\0';
pos = os_strrchr(brlink, '/'); pos = os_strrchr(brlink, '/');
if (pos == NULL) if (pos == NULL)
return -1; return -1;