|
 |
d8a888d |
From 103040a94970a52dde285a24f0fbb5193ea74d84 Mon Sep 17 00:00:00 2001
|
|
|
d8a888d |
From: =?UTF-8?q?Jarom=C3=ADr=20Kon=C4=8Dick=C3=BD?= <jkoncick@redhat.com>
|
|
|
d8a888d |
Date: Tue, 15 Oct 2013 21:55:52 +0200
|
|
|
d8a888d |
Subject: [PATCH] fix potential buffer overflows reported by static analysis
|
|
|
d8a888d |
|
|
|
d8a888d |
(cherry picked from commit 8f586939999e039563fee6bca4685895067a2b77)
|
|
|
d8a888d |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
d8a888d |
---
|
|
|
d8a888d |
arptables.c | 9 +++++----
|
|
|
d8a888d |
libarptc/libarptc_incl.c | 16 ++++++++++------
|
|
|
d8a888d |
2 files changed, 15 insertions(+), 10 deletions(-)
|
|
|
d8a888d |
|
|
|
d8a888d |
diff --git a/arptables.c b/arptables.c
|
|
|
d8a888d |
index 8ef445a4700c4..4da6fea980bb9 100644
|
|
|
d8a888d |
--- a/arptables.c
|
|
|
d8a888d |
+++ b/arptables.c
|
|
|
d8a888d |
@@ -1270,7 +1270,7 @@ print_firewall(const struct arpt_entry *fw,
|
|
|
d8a888d |
sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
|
|
|
d8a888d |
else
|
|
|
d8a888d |
sprintf(buf, "%s", addr_to_anyname(&(fw->arp.src)));
|
|
|
d8a888d |
- strcat(buf, mask_to_dotted(&(fw->arp.smsk)));
|
|
|
d8a888d |
+ strncat(buf, mask_to_dotted(&(fw->arp.smsk)), sizeof(buf) - strlen(buf) -1);
|
|
|
d8a888d |
printf("-s %s ", buf);
|
|
|
d8a888d |
}
|
|
|
d8a888d |
|
|
|
d8a888d |
@@ -1294,7 +1294,7 @@ after_devsrc:
|
|
|
d8a888d |
sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
|
|
|
d8a888d |
else
|
|
|
d8a888d |
sprintf(buf, "%s", addr_to_anyname(&(fw->arp.tgt)));
|
|
|
d8a888d |
- strcat(buf, mask_to_dotted(&(fw->arp.tmsk)));
|
|
|
d8a888d |
+ strncat(buf, mask_to_dotted(&(fw->arp.tmsk)), sizeof(buf) - strlen(buf) -1);
|
|
|
d8a888d |
printf("-d %s ", buf);
|
|
|
d8a888d |
}
|
|
|
d8a888d |
|
|
|
d8a888d |
@@ -1796,7 +1796,7 @@ int do_command(int argc, char *argv[], char **table, arptc_handle_t *handle)
|
|
|
d8a888d |
*table, arptc_strerror(errno));
|
|
|
d8a888d |
}
|
|
|
d8a888d |
}
|
|
|
d8a888d |
- }
|
|
|
d8a888d |
+ }
|
|
|
d8a888d |
|
|
|
d8a888d |
memset(&fw, 0, sizeof(fw));
|
|
|
d8a888d |
opts = original_opts;
|
|
|
d8a888d |
@@ -2064,7 +2064,8 @@ int do_command(int argc, char *argv[], char **table, arptc_handle_t *handle)
|
|
|
d8a888d |
|
|
|
d8a888d |
target->t = fw_calloc(1, size);
|
|
|
d8a888d |
target->t->u.target_size = size;
|
|
|
d8a888d |
- strcpy(target->t->u.user.name, jumpto);
|
|
|
d8a888d |
+ strncpy(target->t->u.user.name, jumpto, sizeof(target->t->u.user.name));
|
|
|
d8a888d |
+ target->t->u.user.name[sizeof(target->t->u.user.name)-1] = '\0';
|
|
|
d8a888d |
/*
|
|
|
d8a888d |
target->init(target->t, &fw.nfcache);
|
|
|
d8a888d |
*/
|
|
|
d8a888d |
diff --git a/libarptc/libarptc_incl.c b/libarptc/libarptc_incl.c
|
|
|
d8a888d |
index 2fa3d43576933..9c1aeac7ca3de 100644
|
|
|
d8a888d |
--- a/libarptc/libarptc_incl.c
|
|
|
d8a888d |
+++ b/libarptc/libarptc_incl.c
|
|
|
d8a888d |
@@ -209,8 +209,10 @@ alloc_handle(const char *tablename, unsigned int size, unsigned int num_rules)
|
|
|
d8a888d |
h->counter_map = (void *)h
|
|
|
d8a888d |
+ sizeof(STRUCT_TC_HANDLE)
|
|
|
d8a888d |
+ size;
|
|
|
d8a888d |
- strcpy(h->info.name, tablename);
|
|
|
d8a888d |
- strcpy(h->entries.name, tablename);
|
|
|
d8a888d |
+ strncpy(h->info.name, tablename, sizeof(h->info.name));
|
|
|
d8a888d |
+ h->info.name[sizeof(h->info.name)-1] = '\0';
|
|
|
d8a888d |
+ strncpy(h->entries.name, tablename, sizeof(h->entries.name));
|
|
|
d8a888d |
+ h->entries.name[sizeof(h->entries.name)-1] = '\0';
|
|
|
d8a888d |
|
|
|
d8a888d |
return h;
|
|
|
d8a888d |
}
|
|
|
d8a888d |
@@ -357,8 +359,9 @@ add_chain(STRUCT_ENTRY *e, TC_HANDLE_T h, STRUCT_ENTRY **prev)
|
|
|
d8a888d |
h->cache_chain_heads[h->cache_num_chains-1].end
|
|
|
d8a888d |
= *prev;
|
|
|
d8a888d |
|
|
|
d8a888d |
- strcpy(h->cache_chain_heads[h->cache_num_chains].name,
|
|
|
d8a888d |
- (const char *)GET_TARGET(e)->data);
|
|
|
d8a888d |
+ strncpy(h->cache_chain_heads[h->cache_num_chains].name,
|
|
|
d8a888d |
+ (const char *)GET_TARGET(e)->data, TABLE_MAXNAMELEN-1);
|
|
|
d8a888d |
+ h->cache_chain_heads[h->cache_num_chains].name[TABLE_MAXNAMELEN-1] = '\0';
|
|
|
d8a888d |
h->cache_chain_heads[h->cache_num_chains].start
|
|
|
d8a888d |
= (void *)e + e->next_offset;
|
|
|
d8a888d |
h->cache_num_chains++;
|
|
|
d8a888d |
@@ -368,8 +371,9 @@ add_chain(STRUCT_ENTRY *e, TC_HANDLE_T h, STRUCT_ENTRY **prev)
|
|
|
d8a888d |
h->cache_chain_heads[h->cache_num_chains-1].end
|
|
|
d8a888d |
= *prev;
|
|
|
d8a888d |
|
|
|
d8a888d |
- strcpy(h->cache_chain_heads[h->cache_num_chains].name,
|
|
|
d8a888d |
- h->hooknames[builtin-1]);
|
|
|
d8a888d |
+ strncpy(h->cache_chain_heads[h->cache_num_chains].name,
|
|
|
d8a888d |
+ h->hooknames[builtin-1], TABLE_MAXNAMELEN-1);
|
|
|
d8a888d |
+ h->cache_chain_heads[h->cache_num_chains].name[TABLE_MAXNAMELEN-1] = '\0';
|
|
|
d8a888d |
h->cache_chain_heads[h->cache_num_chains].start
|
|
|
d8a888d |
= (void *)e;
|
|
|
d8a888d |
h->cache_num_chains++;
|
|
|
d8a888d |
--
|
|
|
d8a888d |
2.21.0
|
|
|
d8a888d |
|