DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Verify that readlink() did not truncate result

Browse source 
linux_br_get() was forcing null termination on the buffer, but did not
check whether the string could have been truncated. Make this more
strict by rejecting any truncation case.

Signed-hostap: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2013-10-26 12:25:20 +03:00
parent f5eb9da304
commit 0f0120148a
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/drivers/linux_ioctl.c
View file

@ -204,11 +204,14 @@ int linux_br_del_if(int sock, const char *brname, const char *ifname)
int linux_br_get(char *brname, const char *ifname)
{
char path[128], brlink[128], *pos;
ssize_t res;
os_snprintf(path, sizeof(path), "/sys/class/net/%s/brport/bridge",
ifname);
os_memset(brlink, 0, sizeof(brlink));
if (readlink(path, brlink, sizeof(brlink) - 1) < 0)
res = readlink(path, brlink, sizeof(brlink));
if (res < 0 || (size_t) res >= sizeof(brlink))
return -1;
brlink[res] = '\0';
pos = os_strrchr(brlink, '/');
if (pos == NULL)
return -1;