Files
linux/include/uapi/linux
Jon Maloy 7494cfa6d3 tipc: avoid possible string overflow
gcc points out that the combined length of the fixed-length inputs to
l->name is larger than the destination buffer size:

net/tipc/link.c: In function 'tipc_link_create':
net/tipc/link.c:465:26: error: '%s' directive writing up to 32 bytes
into a region of size between 26 and 58 [-Werror=format-overflow=]
sprintf(l->name, "%s:%s-%s:unknown", self_str, if_name, peer_str);

net/tipc/link.c:465:2: note: 'sprintf' output 11 or more bytes
(assuming 75) into a destination of size 60
sprintf(l->name, "%s:%s-%s:unknown", self_str, if_name, peer_str);

A detailed analysis reveals that the theoretical maximum length of
a link name is:
max self_str + 1 + max if_name + 1 + max peer_str + 1 + max if_name =
16 + 1 + 15 + 1 + 16 + 1 + 15 = 65
Since we also need space for a trailing zero we now set MAX_LINK_NAME
to 68.

Just to be on the safe side we also replace the sprintf() call with
snprintf().

Fixes: 25b0b9c4e8 ("tipc: handle collisions of 32-bit node address
hash values")
Reported-by: Arnd Bergmann <arnd@arndb.de>

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-31 22:19:52 -04:00
..
2017-08-31 17:32:38 -04:00
2017-11-24 16:22:58 -07:00
2018-01-25 19:32:55 -05:00
2017-11-08 11:20:49 +09:00
2017-12-14 10:35:15 -05:00
2017-11-28 16:54:00 +01:00
2018-03-05 10:43:37 -05:00
2018-01-14 23:06:30 -05:00
2018-01-16 16:47:29 +01:00
2018-01-31 10:10:32 -06:00
2018-02-06 22:53:56 +00:00
2017-11-24 10:18:41 +00:00
2017-11-16 10:49:00 +09:00
2017-11-11 18:53:16 +09:00
2018-03-31 22:19:52 -04:00
2018-03-23 12:25:54 -04:00
2017-11-27 16:19:52 -05:00
2018-02-06 18:32:44 -08:00
2016-12-16 00:13:32 +02:00