[B.A.T.M.A.N.] [PATCH 02/10] alfred: Force null termination of string after strncpy

Sven Eckelmann sven at narfation.org
Sat May 24 13:44:07 CEST 2014


strncpy doesn't terminate the string with a '\0' character when the length
of the destination memory location was shorter than the source string.
Accessing it again with string related functions isn't safe after such a
semi-failed copy and the caller has to handle it. The easiest way is to
always set the last character in the destination buffer to '\0' after the
strncpy was called.

Signed-off-by: Sven Eckelmann <sven at narfation.org>

---
 debugfs.c | 1 +
 netsock.c | 1 +
 server.c  | 1 +
 vis/vis.c | 1 +
 4 files changed, 4 insertions(+)

diff --git a/debugfs.c b/debugfs.c
index 1e9418d..adada7c 100644
--- a/debugfs.c
+++ b/debugfs.c
@@ -154,6 +154,7 @@ char *debugfs_mount(const char *mountpoint)
 
 	/* save the mountpoint */
 	strncpy(debugfs_mountpoint, mountpoint, sizeof(debugfs_mountpoint));
+	debugfs_mountpoint[sizeof(debugfs_mountpoint) - 1] = '\0';
 	debugfs_found = 1;
 
 	return debugfs_mountpoint;
diff --git a/netsock.c b/netsock.c
index 08d2959..8712c11 100644
--- a/netsock.c
+++ b/netsock.c
@@ -59,6 +59,7 @@ int netsock_open(struct globals *globals)
 
 	memset(&ifr, 0, sizeof(ifr));
 	strncpy(ifr.ifr_name, globals->interface, IFNAMSIZ);
+	ifr.ifr_name[IFNAMSIZ - 1] = '\0';
 	if (ioctl(sock, SIOCGIFINDEX, &ifr) == -1) {
 		fprintf(stderr, "can't get interface: %s\n", strerror(errno));
 		goto err;
diff --git a/server.c b/server.c
index fdd97d4..e4465dc 100644
--- a/server.c
+++ b/server.c
@@ -242,6 +242,7 @@ static void check_if_socket(struct globals *globals)
 
 	memset(&ifr, 0, sizeof(ifr));
 	strncpy(ifr.ifr_name, globals->interface, IFNAMSIZ);
+	ifr.ifr_name[IFNAMSIZ - 1] = '\0';
 	if (ioctl(sock, SIOCGIFINDEX, &ifr) == -1) {
 		fprintf(stderr, "can't get interface: %s, closing netsock\n",
 			strerror(errno));
diff --git a/vis/vis.c b/vis/vis.c
index b51fede..9031b27 100644
--- a/vis/vis.c
+++ b/vis/vis.c
@@ -102,6 +102,7 @@ static int get_if_mac(char *ifname, uint8_t *mac)
 	int sock, ret;
 
 	strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+	ifr.ifr_name[IFNAMSIZ - 1] = '\0';
 
 	if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
 		fprintf(stderr, "can't get interface: %s\n", strerror(errno));
-- 
2.0.0.rc2



More information about the B.A.T.M.A.N mailing list