diff options
| author | Marek Lindner <lindner_marek@yahoo.de> | 2013-04-27 16:22:28 +0800 |
|---|---|---|
| committer | Antonio Quartulli <ordex@autistici.org> | 2013-05-09 12:39:44 +0200 |
| commit | 293c9c1cef6be46ad72b528fa79c3ff034551fe0 (patch) | |
| tree | 2ecf02ef21613e3a69cb0ebf333ad1ba8ff68665 /net | |
| parent | 4f924b2aa4d3cb30f07e57d6b608838edcbc0d88 (diff) | |
| download | linux-293c9c1cef6be46ad72b528fa79c3ff034551fe0.tar.bz2 | |
batman-adv: check proto length before accessing proto string buffer
batadv_param_set_ra() strips the trailing '\n' from the supplied
string buffer without checking the length of the buffer first. This
patches avoids random memory access and associated potential
crashes.
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/batman-adv/main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index 3e30a0f1b908..9c620cd3b5f7 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp) char *algo_name = (char *)val; size_t name_len = strlen(algo_name); - if (algo_name[name_len - 1] == '\n') + if (name_len > 0 && algo_name[name_len - 1] == '\n') algo_name[name_len - 1] = '\0'; bat_algo_ops = batadv_algo_get(algo_name); |