Commit 293c9c1c authored Apr 27, 2013 by Marek Lindner Committed by Antonio Quartulli May 09, 2013

batman-adv: check proto length before accessing proto string buffer



batadv_param_set_ra() strips the trailing '\n' from the supplied
string buffer without checking the length of the buffer first. This
patches avoids random memory access and associated potential
crashes.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>

parent 4f924b2a

net/batman-adv/main.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char val, const struct kernel_param kp)
	char algo_name = (char )val;		char algo_name = (char )val;
	size_t name_len = strlen(algo_name);		size_t name_len = strlen(algo_name);

	if (algo_name[name_len - 1] == '\n')		if (name_len > 0 && algo_name[name_len - 1] == '\n')
	algo_name[name_len - 1] = '\0';		algo_name[name_len - 1] = '\0';

	bat_algo_ops = batadv_algo_get(algo_name);		bat_algo_ops = batadv_algo_get(algo_name);