From 8ac8129d710b8a084ce213791874330aa30ec70e Mon Sep 17 00:00:00 2001 From: Andrea Claudi Date: Mon, 29 Apr 2019 20:08:08 +0200 Subject: [PATCH] tc/m_xt: Fix for potential string buffer overflows Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1465646 Upstream Status: iproute2.git commit 56270e54661e8 commit 56270e54661e8ca51d4b3661b9f9bb12a0a40d95 Author: Phil Sutter Date: Thu Aug 24 11:51:49 2017 +0200 tc/m_xt: Fix for potential string buffer overflows - Use strncpy() when writing to target->t->u.user.name and make sure the final byte remains untouched (xtables_calloc() set it to zero). - 'tname' length sanitization was completely wrong: If it's length exceeded the 16 bytes available in 'k', passing a length value of 16 to strncpy() would overwrite the previously NULL'ed 'k[15]'. Also, the sanitization has to happen if 'tname' is exactly 16 bytes long as well. Signed-off-by: Phil Sutter --- tc/m_xt.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tc/m_xt.c b/tc/m_xt.c index ad52d239caf61..9218b14594403 100644 --- a/tc/m_xt.c +++ b/tc/m_xt.c @@ -95,7 +95,8 @@ build_st(struct xtables_target *target, struct xt_entry_target *t) if (t == NULL) { target->t = xtables_calloc(1, size); target->t->u.target_size = size; - strcpy(target->t->u.user.name, target->name); + strncpy(target->t->u.user.name, target->name, + sizeof(target->t->u.user.name) - 1); target->t->u.user.revision = target->revision; if (target->init != NULL) @@ -277,8 +278,8 @@ static int parse_ipt(struct action_util *a, int *argc_p, } fprintf(stdout, " index %d\n", index); - if (strlen(tname) > 16) { - size = 16; + if (strlen(tname) >= 16) { + size = 15; k[15] = 0; } else { size = 1 + strlen(tname); -- 2.20.1