Messages in this thread Patch in this message |  | | | Date | Fri, 24 Mar 2006 20:11:53 -0800 | | From | Greg KH <> | | Subject | [PATCH 07/08] NET: Ensure device name passed to SO_BINDTODEVICE is NULL terminated. |
| |
From: "David S. Miller" <davem@davemloft.net>
The user can pass us arbitrary garbage so we should ensure the string they give us is null terminated before we pass it on to dev_get_by_index() et al.
Found by Solar Designer.
Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/core/sock.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- linux-2.6.15.6.orig/net/core/sock.c +++ linux-2.6.15.6/net/core/sock.c @@ -403,8 +403,9 @@ set_rcvbuf: if (!valbool) { sk->sk_bound_dev_if = 0; } else { - if (optlen > IFNAMSIZ) - optlen = IFNAMSIZ; + if (optlen > IFNAMSIZ - 1) + optlen = IFNAMSIZ - 1; + memset(devname, 0, sizeof(devname)); if (copy_from_user(devname, optval, optlen)) { ret = -EFAULT; break; - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |