Messages in this thread | | | From | Cong Wang <> | Date | Wed, 1 Mar 2017 21:13:02 -0800 | Subject | Re: [PATCH v4] net: don't call strlen() on the user buffer in packet_bind_spkt() |
| |
On Wed, Mar 1, 2017 at 3:57 AM, Alexander Potapenko <glider@google.com> wrote: > This happens because addr.sa_data copied from the userspace is not > zero-terminated, and copying it with strlcpy() in packet_bind_spkt() > results in calling strlen() on the kernel copy of that non-terminated > buffer.
Very similar to
commit b301f2538759933cf9ff1f7c4f968da72e3f0757 Author: Pablo Neira Ayuso <pablo@netfilter.org> Date: Thu Mar 24 21:29:53 2016 +0100
netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES
| |