Commit 293c9c1c authored by Marek Lindner's avatar Marek Lindner Committed by Antonio Quartulli

batman-adv: check proto length before accessing proto string buffer

batadv_param_set_ra() strips the trailing '\n' from the supplied
string buffer without checking the length of the buffer first. This
patches avoids random memory access and associated potential
crashes.
Reported-by: default avatarSasha Levin <sasha.levin@oracle.com>
Signed-off-by: default avatarMarek Lindner <lindner_marek@yahoo.de>
Signed-off-by: default avatarAntonio Quartulli <ordex@autistici.org>
parent 4f924b2a
...@@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp) ...@@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp)
char *algo_name = (char *)val; char *algo_name = (char *)val;
size_t name_len = strlen(algo_name); size_t name_len = strlen(algo_name);
if (algo_name[name_len - 1] == '\n') if (name_len > 0 && algo_name[name_len - 1] == '\n')
algo_name[name_len - 1] = '\0'; algo_name[name_len - 1] = '\0';
bat_algo_ops = batadv_algo_get(algo_name); bat_algo_ops = batadv_algo_get(algo_name);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment