tipc: guard against string buffer overrun
[ Upstream commit 6555a2a9212be6983d2319d65276484f7c5f431a ] Smatch reports that copying media_name and if_name to name_parts may overwrite the destination. .../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16) .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16) This does seem to be the case so guard against this possibility by using strscpy() and failing if truncation occurs. Introduced by commit b97bf3fd ("[TIPC] Initial merge") Compile tested only. Reviewed-by:Jakub Kicinski <kuba@kernel.org> Signed-off-by:
Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20240801-tipic-overrun-v2-1-c5b869d1f074@kernel.org Signed-off-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
Sasha Levin <sashal@kernel.org> (cherry picked from commit 8298b6e45fb4d8944f356b08e4ea3e54df5e0488) Signed-off-by:
Vegard Nossum <vegard.nossum@oracle.com> Signed-off-by:
Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Loading
Please register or sign in to comment