Repository : ssh://git@open-mesh.org/batman-adv
On branch : next
commit 32cadb4f1ba0dd9b08fe5dedf71c4420d939c370 Author: Marek Lindner lindner_marek@yahoo.de Date: Sat Apr 27 16:22:28 2013 +0800
batman-adv: check proto length before accessing proto string buffer
batadv_param_set_ra() strips the trailing '\n' from the supplied string buffer without checking the length of the buffer first. This patches avoids random memory access and associated potential crashes.
Reported-by: Sasha Levin sasha.levin@oracle.com Signed-off-by: Marek Lindner lindner_marek@yahoo.de
32cadb4f1ba0dd9b08fe5dedf71c4420d939c370 main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/main.c b/main.c index aae96ca..7dac212 100644 --- a/main.c +++ b/main.c @@ -476,7 +476,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp) char *algo_name = (char *)val; size_t name_len = strlen(algo_name);
- if (algo_name[name_len - 1] == '\n') + if (name_len > 0 && algo_name[name_len - 1] == '\n') algo_name[name_len - 1] = '\0';
bat_algo_ops = batadv_algo_get(algo_name);