Skip to content
Snippets Groups Projects
Commit 373f49f0 authored by Oto Šťáva's avatar Oto Šťáva
Browse files

daemon/network: fix heap-buffer-overflow in endpoint key generation

Reproducible by listening on an interface by name, ASAN reports a
heap-buffer-overflow. This was a regression caused by !1286, which did
not account for null-terminators properly.
parent f56e1c08
Branches
Tags
1 merge request!1355daemon/network: fix heap-buffer-overflow in endpoint key generation
Pipeline #105658 canceled with stages
in 1 hour, 14 minutes, and 49 seconds
...@@ -302,6 +302,8 @@ void network_deinit(struct network *net) ...@@ -302,6 +302,8 @@ void network_deinit(struct network *net)
} }
} }
/** Creates an endpoint key for use with a `trie_t` and stores it into `dst`.
* Returns the actual length of the generated key. */
static ssize_t endpoint_key_create(struct endpoint_key_storage *dst, static ssize_t endpoint_key_create(struct endpoint_key_storage *dst,
const char *addr_str, const char *addr_str,
const struct sockaddr *sa) const struct sockaddr *sa)
...@@ -317,8 +319,11 @@ static ssize_t endpoint_key_create(struct endpoint_key_storage *dst, ...@@ -317,8 +319,11 @@ static ssize_t endpoint_key_create(struct endpoint_key_storage *dst,
} else { } else {
struct endpoint_key_ifname *key = &dst->ifname; struct endpoint_key_ifname *key = &dst->ifname;
key->type = ENDPOINT_KEY_IFNAME; key->type = ENDPOINT_KEY_IFNAME;
/* The subtractions and additions of 1 are here to account for
* null-terminators. */
strncpy(key->ifname, addr_str, sizeof(key->ifname) - 1); strncpy(key->ifname, addr_str, sizeof(key->ifname) - 1);
return sizeof(struct endpoint_key) + strnlen(key->ifname, sizeof(key->ifname)); return sizeof(struct endpoint_key) + strlen(key->ifname) + 1;
} }
} }
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment