Commit 7ec3335d authored Jul 16, 2024 by Shigeru Yoshida Committed by Greg Kroah-Hartman Aug 19, 2024

tipc: Return non-zero value from tipc_udp_addr2str() on error



[ Upstream commit fa96c6baef1b5385e2f0c0677b32b3839e716076 ]

tipc_udp_addr2str() should return non-zero value if the UDP media
address is invalid. Otherwise, a buffer overflow access can occur in
tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP
media address.

Fixes: d0f91938 ("tipc: add ip/udp media type")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Tung Nguyen <tung.q.nguyen@endava.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 6c9261a2

net/tipc/udp_media.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -127,8 +127,11 @@ static int tipc_udp_addr2str(struct tipc_media_addr a, char buf, int size)
		snprintf(buf, size, "%pI4:%u", &ua->ipv4, ntohs(ua->port));
		else if (ntohs(ua->proto) == ETH_P_IPV6)
		snprintf(buf, size, "%pI6:%u", &ua->ipv6, ntohs(ua->port));
		else
		else {
		pr_err("Invalid UDP media address\n");
		return 1;
		}

		return 0;
		}