Fix out of bounds buffer access in rtnl_netem_set_delay_distribution()
PATCH 1/1 Fix out of bounds buffer access in rtnl_netem_set_delay_distribution()
sizeof(test_path) returns the array size
and not the number of array elements.
Detected by cppcheck
--- lib/route/sch/netem.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
lib/route/sch/netem.c +4 -3
@@ -861,7 +861,7 @@ int rtnl_netem_set_delay_distribution(struct rtnl_qdisc *qdisc, const char *distreturn -NLE_NOMEM ;FILE *f =NULL ; -int i, n =0 ; +int i =0 , n =0 ;size_t len =2048 ;char *line;char name[NAME_MAX ];
@@ -873,11 +873,12 @@ int rtnl_netem_set_delay_distribution(struct rtnl_qdisc *qdisc, const char *diststrcpy (dist_suffix,"" );/* Check several locations for the dist file */ -char *test_path[] = {"" ,"./" ,"/usr/lib/tc/" ,"/usr/local/lib/tc/" }; +char *test_path[] = {"" ,"./" ,"/usr/lib/tc/" ,"/usr/local/lib/tc/" ,NULL }; -for (i =0 ; i <sizeof (test_path) && f ==NULL ; i++) { +while (f ==NULL && test_path[i] !=NULL ) {snprintf (name,NAME_MAX ,"%s%s%s" , test_path[i], dist_type, dist_suffix); f =fopen (name,"r" ); + ++i; }if ( f ==NULL )
Signature · 1 line
1.7.11.7
Pablo Neira Ayuso
maintainerHi Thomas!
Quoted 8 lines · Thomas Jarosch
sizeof(test_path)returns the array size
and not the number of array elements.Detected by cppcheck
Signed-off-by Thomas Jarosch <[email protected]>--- lib/route/sch/netem.c | 7 ++++---
These two fixes you sent belong to non-netfilter libnl subsystems. You should better go to libnl mailing and post them there.
Quoted 4 lines · Thomas Jarosch
sizeof(test_path)returns the array size
and not the number of array elements.Detected by cppcheck
Is this already fixed in libnl upstream? I'm considering just doing a full merge.
Quoted 8 lines · On Thursday, 27. December 2012 07:23:12 Patrick McHardy wrote:
Quoted 4 lines · Thomas Jarosch
sizeof(test_path)returns the array size
and not the number of array elements.Detected by cppcheck
Is this already fixed in libnl upstream? I'm considering just doing a full merge.
This one has been fixed upstream.
(I wasn't even aware there's an upstream... I just tested some cppcheck changes on the git trees I had on disc)