proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-13 18:02:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

coverity: ifr_name buffer not NULL terminated

Browse Source 
The kernel (net/core/dev_ioctl.c:dev_ioctl()) is going to NULL terminate
this name after the copy-in of the ifr, so even though this is a fixed
sized array the last byte isn't usable as part of the name. All the ioctls
we're using go through this code path.

Use the ifr name in the DEBUG message in case it was possibly truncated.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
This commit is contained in:
Dwight Engen 2013-10-29 09:24:29 -04:00 committed by Serge Hallyn
parent e853a32df1
commit 5da6aa8c71
3 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/lxc/conf.c
View File

@ -2059,6 +2059,7 @@ static int setup_hw_addr(char *hwaddr, const char *ifname)
}
memcpy(ifr.ifr_name, ifname, IFNAMSIZ);
ifr.ifr_name[IFNAMSIZ-1] = '\0';
memcpy((char *) &ifr.ifr_hwaddr, (char *) &sockaddr, sizeof(sockaddr));
process_lock();
@ -2076,7 +2077,7 @@ static int setup_hw_addr(char *hwaddr, const char *ifname)
if (ret)
ERROR("ioctl failure : %s", strerror(errno));
DEBUG("mac address '%s' on '%s' has been setup", hwaddr, ifname);
DEBUG("mac address '%s' on '%s' has been setup", hwaddr, ifr.ifr_name);
return ret;
}

3
src/lxc/lxc_user_nic.c
View File

@ -473,7 +473,8 @@ int lxc_bridge_attach(const char *bridge, const char *ifname)
if (fd < 0)
return -errno;
strncpy(ifr.ifr_name, bridge, IFNAMSIZ);
strncpy(ifr.ifr_name, bridge, IFNAMSIZ-1);
ifr.ifr_name[IFNAMSIZ-1] = '\0';
ifr.ifr_ifindex = index;
err = ioctl(fd, SIOCBRADDIF, &ifr);
close(fd);

3
src/lxc/network.c
View File

@ -1009,7 +1009,8 @@ int lxc_bridge_attach(const char *bridge, const char *ifname)
if (fd < 0)
return -errno;
strncpy(ifr.ifr_name, bridge, IFNAMSIZ);
strncpy(ifr.ifr_name, bridge, IFNAMSIZ-1);
ifr.ifr_name[IFNAMSIZ-1] = '\0';
ifr.ifr_ifindex = index;
err = ioctl(fd, SIOCBRADDIF, &ifr);
process_lock();