tipc: fix an infoleak in tipc_nl_compat_link_dump
link_info.str is a char array of size 60. Memory after the NULL byte is not initialized. Sending the whole object out can cause a leak. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Родитель
ce25d66ad5
Коммит
5d2be1422e
|
@ -604,7 +604,8 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,
|
|||
|
||||
link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]);
|
||||
link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP]));
|
||||
strcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]));
|
||||
nla_strlcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]),
|
||||
TIPC_MAX_LINK_NAME);
|
||||
|
||||
return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO,
|
||||
&link_info, sizeof(link_info));
|
||||
|
|
Загрузка…
Ссылка в новой задаче