803fb7
From f50fbeaf7c2ce57027f774d02d9e2b09f810ec2a Mon Sep 17 00:00:00 2001
803fb7
From: Tom Gundersen <teg@jklm.no>
803fb7
Date: Thu, 21 May 2015 15:22:07 +0200
803fb7
Subject: [PATCH] udev: link-config - fix corruption
803fb7
803fb7
The parser used for MTU and Speed expects them to be size_t, not unsigned int.
803fb7
803fb7
This caused a corruption in the rest of the structure.
803fb7
803fb7
Reported by David O Neill <david.m.oneill@intel.com>.
803fb7
803fb7
(cherry picked from commit dab495dc23bf9a5ba0487a057bb594355555a0e9)
803fb7
803fb7
Cherry-picked from: dab495d
803fb7
Resolves: #1222517
803fb7
---
803fb7
 src/udev/net/link-config.c | 11 ++++++-----
803fb7
 src/udev/net/link-config.h |  4 ++--
803fb7
 2 files changed, 8 insertions(+), 7 deletions(-)
803fb7
803fb7
diff --git a/src/udev/net/link-config.c b/src/udev/net/link-config.c
803fb7
index 8b3dc45d4..489593f4f 100644
803fb7
--- a/src/udev/net/link-config.c
803fb7
+++ b/src/udev/net/link-config.c
803fb7
@@ -177,6 +177,9 @@ static int load_link(link_config_ctx *ctx, const char *filename) {
803fb7
         else
803fb7
                 log_debug("Parsed configuration file %s", filename);
803fb7
 
803fb7
+        if (link->mtu > UINT_MAX || link->speed > UINT_MAX)
803fb7
+                return -ERANGE;
803fb7
+
803fb7
         link->filename = strdup(filename);
803fb7
 
803fb7
         LIST_PREPEND(links, ctx->links, link);
803fb7
@@ -379,10 +382,9 @@ int link_config_apply(link_config_ctx *ctx, link_config *config,
803fb7
         if (!old_name)
803fb7
                 return -EINVAL;
803fb7
 
803fb7
-        r = ethtool_set_speed(&ctx->ethtool_fd, old_name, config->speed / 1024,
803fb7
-                              config->duplex);
803fb7
+        r = ethtool_set_speed(&ctx->ethtool_fd, old_name, config->speed / 1024, config->duplex);
803fb7
         if (r < 0)
803fb7
-                log_warning_errno(r, "Could not set speed or duplex of %s to %u Mbps (%s): %m",
803fb7
+                log_warning_errno(r, "Could not set speed or duplex of %s to %zu Mbps (%s): %m",
803fb7
                                   old_name, config->speed / 1024,
803fb7
                                   duplex_to_string(config->duplex));
803fb7
 
803fb7
@@ -461,8 +463,7 @@ int link_config_apply(link_config_ctx *ctx, link_config *config,
803fb7
                         mac = config->mac;
803fb7
         }
803fb7
 
803fb7
-        r = rtnl_set_link_properties(&ctx->rtnl, ifindex, config->alias, mac,
803fb7
-                                     config->mtu);
803fb7
+        r = rtnl_set_link_properties(&ctx->rtnl, ifindex, config->alias, mac, config->mtu);
803fb7
         if (r < 0)
803fb7
                 return log_warning_errno(r, "Could not set Alias, MACAddress or MTU on %s: %m", old_name);
803fb7
 
803fb7
diff --git a/src/udev/net/link-config.h b/src/udev/net/link-config.h
803fb7
index cb434d1ae..f2e917488 100644
803fb7
--- a/src/udev/net/link-config.h
803fb7
+++ b/src/udev/net/link-config.h
803fb7
@@ -67,8 +67,8 @@ struct link_config {
803fb7
         NamePolicy *name_policy;
803fb7
         char *name;
803fb7
         char *alias;
803fb7
-        unsigned int mtu;
803fb7
-        unsigned int speed;
803fb7
+        size_t mtu;
803fb7
+        size_t speed;
803fb7
         Duplex duplex;
803fb7
         WakeOnLan wol;
803fb7