Skip to content

Commit

Permalink
batman-adv: check proto length before accessing proto string buffer
Browse files Browse the repository at this point in the history
batadv_param_set_ra() strips the trailing '\n' from the supplied
string buffer without checking the length of the buffer first. This
patches avoids random memory access and associated potential
crashes.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
  • Loading branch information
Marek Lindner authored and Antonio Quartulli committed May 9, 2013
1 parent 4f924b2 commit 293c9c1
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion net/batman-adv/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp)
char *algo_name = (char *)val;
size_t name_len = strlen(algo_name);

if (algo_name[name_len - 1] == '\n')
if (name_len > 0 && algo_name[name_len - 1] == '\n')
algo_name[name_len - 1] = '\0';

bat_algo_ops = batadv_algo_get(algo_name);
Expand Down

0 comments on commit 293c9c1

Please sign in to comment.