|
 |
049c96 |
From 5b5cbaf1e54a9c0fb169465913c1250c560b487a Mon Sep 17 00:00:00 2001
|
|
|
049c96 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
049c96 |
Date: Thu, 18 Feb 2016 14:07:42 +0100
|
|
|
049c96 |
Subject: [PATCH] libnetlink: don't confuse variables in rtnl_talk()
|
|
|
049c96 |
|
|
|
049c96 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1288042
|
|
|
049c96 |
Upstream Status: iproute2.git commit ed108cfc0260b
|
|
|
049c96 |
|
|
|
049c96 |
commit ed108cfc0260b6b751647982b77d6363b1defb15
|
|
|
049c96 |
Author: Nicolas Dichtel <nicolas.dichtel@6wind.com>
|
|
|
049c96 |
Date: Thu Dec 3 17:13:48 2015 +0100
|
|
|
049c96 |
|
|
|
049c96 |
libnetlink: don't confuse variables in rtnl_talk()
|
|
|
049c96 |
|
|
|
049c96 |
There is two variables named 'len' in rtnl_talk. In fact, commit
|
|
|
049c96 |
c079e121a73a didn't work. For example, it was possible to trigger
|
|
|
049c96 |
a seg fault with this command:
|
|
|
049c96 |
$ ip link set gre2 type ip6gre hoplimit 32
|
|
|
049c96 |
|
|
|
049c96 |
Let's rename the argument len to maxlen.
|
|
|
049c96 |
|
|
|
049c96 |
Fixes: c079e121a73a ("libnetlink: add size argument to rtnl_talk")
|
|
|
049c96 |
Reported-by: Thomas Faivre <thomas.faivre@6wind.com>
|
|
|
049c96 |
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
|
|
|
049c96 |
---
|
|
|
049c96 |
lib/libnetlink.c | 6 +++---
|
|
|
049c96 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
049c96 |
|
|
|
049c96 |
diff --git a/lib/libnetlink.c b/lib/libnetlink.c
|
|
|
049c96 |
index 97b79fd..b2a300e 100644
|
|
|
049c96 |
--- a/lib/libnetlink.c
|
|
|
049c96 |
+++ b/lib/libnetlink.c
|
|
|
049c96 |
@@ -311,7 +311,7 @@ int rtnl_dump_filter_nc(struct rtnl_handle *rth,
|
|
|
049c96 |
}
|
|
|
049c96 |
|
|
|
049c96 |
int rtnl_talk(struct rtnl_handle *rtnl, struct nlmsghdr *n,
|
|
|
049c96 |
- struct nlmsghdr *answer, size_t len)
|
|
|
049c96 |
+ struct nlmsghdr *answer, size_t maxlen)
|
|
|
049c96 |
{
|
|
|
049c96 |
int status;
|
|
|
049c96 |
unsigned seq;
|
|
|
049c96 |
@@ -394,7 +394,7 @@ int rtnl_talk(struct rtnl_handle *rtnl, struct nlmsghdr *n,
|
|
|
049c96 |
} else if (!err->error) {
|
|
|
049c96 |
if (answer)
|
|
|
049c96 |
memcpy(answer, h,
|
|
|
049c96 |
- MIN(len, h->nlmsg_len));
|
|
|
049c96 |
+ MIN(maxlen, h->nlmsg_len));
|
|
|
049c96 |
return 0;
|
|
|
049c96 |
}
|
|
|
049c96 |
|
|
|
049c96 |
@@ -406,7 +406,7 @@ int rtnl_talk(struct rtnl_handle *rtnl, struct nlmsghdr *n,
|
|
|
049c96 |
|
|
|
049c96 |
if (answer) {
|
|
|
049c96 |
memcpy(answer, h,
|
|
|
049c96 |
- MIN(len, h->nlmsg_len));
|
|
|
049c96 |
+ MIN(maxlen, h->nlmsg_len));
|
|
|
049c96 |
return 0;
|
|
|
049c96 |
}
|
|
|
049c96 |
|
|
|
049c96 |
--
|
|
|
049c96 |
1.8.3.1
|
|
|
049c96 |
|