Blob Blame History Raw
commit 9ddd2a60249eaf2b2a48bf9af3843fa06cf0a095
Author: Miroslav Lichvar <mlichvar@redhat.com>
Date:   Wed Sep 17 11:11:15 2014 +0200

    Fix copying of device name to ifreq.
    
    Don't overwrite the last NUL with strncpy() and also replace strcpy()
    with strncpy().
    
    Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>

diff --git a/hwstamp_ctl.c b/hwstamp_ctl.c
index ec5dd6d..0d21843 100644
--- a/hwstamp_ctl.c
+++ b/hwstamp_ctl.c
@@ -131,7 +131,7 @@ int main(int argc, char *argv[])
 	memset(&ifreq, 0, sizeof(ifreq));
 	memset(&cfg, 0, sizeof(cfg));
 
-	strncpy(ifreq.ifr_name, device, sizeof(ifreq.ifr_name));
+	strncpy(ifreq.ifr_name, device, sizeof(ifreq.ifr_name) - 1);
 
 	ifreq.ifr_data = (void *) &cfg;
 
diff --git a/sk.c b/sk.c
index f694bbd..a9133fd 100644
--- a/sk.c
+++ b/sk.c
@@ -51,7 +51,7 @@ static int hwts_init(int fd, const char *device, int rx_filter, int one_step)
 	memset(&ifreq, 0, sizeof(ifreq));
 	memset(&cfg, 0, sizeof(cfg));
 
-	strncpy(ifreq.ifr_name, device, sizeof(ifreq.ifr_name));
+	strncpy(ifreq.ifr_name, device, sizeof(ifreq.ifr_name) - 1);
 
 	ifreq.ifr_data = (void *) &cfg;
 	cfg.tx_type    = one_step ? HWTSTAMP_TX_ONESTEP_SYNC : HWTSTAMP_TX_ON;
@@ -85,7 +85,7 @@ int sk_interface_index(int fd, const char *name)
 	int err;
 
 	memset(&ifreq, 0, sizeof(ifreq));
-	strcpy(ifreq.ifr_name, name);
+	strncpy(ifreq.ifr_name, name, sizeof(ifreq.ifr_name) - 1);
 	err = ioctl(fd, SIOCGIFINDEX, &ifreq);
 	if (err < 0) {
 		pr_err("ioctl SIOCGIFINDEX failed: %m");
@@ -154,7 +154,7 @@ int sk_interface_macaddr(const char *name, struct address *mac)
 	int err, fd;
 
 	memset(&ifreq, 0, sizeof(ifreq));
-	strcpy(ifreq.ifr_name, name);
+	strncpy(ifreq.ifr_name, name, sizeof(ifreq.ifr_name) - 1);
 
 	fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
 	if (fd < 0) {

commit 6b459abc8c54189ec3315404057923c039c1796a
Author: Miroslav Lichvar <mlichvar@redhat.com>
Date:   Wed Sep 17 11:11:16 2014 +0200

    Fix Coverity warning in sk_interface_addr().
    
    Copy the address directly to struct sockaddr_in or sockaddr_in6 instead
    of sockaddr as Coverity doesn't seem to understand the union and reports
    a buffer overflow.
    
    Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>

diff --git a/sk.c b/sk.c
index a9133fd..c48cf45 100644
--- a/sk.c
+++ b/sk.c
@@ -191,14 +191,15 @@ int sk_interface_addr(const char *name, int family, struct address *addr)
 			switch (family) {
 			case AF_INET:
 				addr->len = sizeof(addr->sin);
+				memcpy(&addr->sin, i->ifa_addr, addr->len);
 				break;
 			case AF_INET6:
 				addr->len = sizeof(addr->sin6);
+				memcpy(&addr->sin6, i->ifa_addr, addr->len);
 				break;
 			default:
 				continue;
 			}
-			memcpy(&addr->sa, i->ifa_addr, addr->len);
 			result = 0;
 			break;
 		}