• Linus Lüssing's avatar
    batman-adv: Fix possible buffer overflow in softif neigh list output · 9e0b33c2
    Linus Lüssing authored
    When printing the soft interface table the number of entries in the
    softif neigh list are first being counted and a fitting buffer
    allocated. After that the softif neigh list gets locked again and
    the buffer printed - which has the following two issues:
    
    For one thing, the softif neigh list might have grown when reacquiring
    the rcu lock, which results in writing outside of the allocated buffer.
    Furthermore 31 Bytes are not enough for printing an entry with a vid
    of more than 2 digits.
    
    The manual buffering is unnecessary, we can safely print to the seq
    directly during the rcu_read_lock().
    Signed-off-by: default avatarLinus Lüssing <linus.luessing@ascom.ch>
    Signed-off-by: default avatarMarek Lindner <lindner_marek@yahoo.de>
    9e0b33c2
soft-interface.c 16.9 KB