|
 |
ef51e0 |
From 1b3f8332696651e4843b0419425480f134c8347f Mon Sep 17 00:00:00 2001
|
|
|
ef51e0 |
Message-Id: <1b3f8332696651e4843b0419425480f134c8347f.1657569892.git.aclaudi@redhat.com>
|
|
|
ef51e0 |
In-Reply-To: <b30268eda844bdebbb8e5e4f5735e3b1bb666368.1657569892.git.aclaudi@redhat.com>
|
|
|
ef51e0 |
References: <b30268eda844bdebbb8e5e4f5735e3b1bb666368.1657569892.git.aclaudi@redhat.com>
|
|
|
ef51e0 |
From: Andrea Claudi <aclaudi@redhat.com>
|
|
|
ef51e0 |
Date: Mon, 11 Jul 2022 17:57:52 +0200
|
|
|
ef51e0 |
Subject: [PATCH] tc: flower: Fix buffer overflow on large labels
|
|
|
ef51e0 |
|
|
|
ef51e0 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2099364
|
|
|
ef51e0 |
Upstream Status: unknown commit 73590d95
|
|
|
ef51e0 |
|
|
|
ef51e0 |
commit 73590d9573148804034a88ceb2f6b7ca1545561f
|
|
|
ef51e0 |
Author: Paul Blakey <paulb@nvidia.com>
|
|
|
ef51e0 |
Date: Sun Dec 5 15:20:25 2021 +0200
|
|
|
ef51e0 |
|
|
|
ef51e0 |
tc: flower: Fix buffer overflow on large labels
|
|
|
ef51e0 |
|
|
|
ef51e0 |
Buffer is 64bytes, but label printing can take 66bytes printing
|
|
|
ef51e0 |
in hex, and will overflow when setting the string delimiter ('\0').
|
|
|
ef51e0 |
|
|
|
ef51e0 |
Fix that by increasing the print buffer size.
|
|
|
ef51e0 |
|
|
|
ef51e0 |
Example of overflowing ct_label:
|
|
|
ef51e0 |
ct_label 11111111111111111111111111111111/11111111111111111111111111111111
|
|
|
ef51e0 |
|
|
|
ef51e0 |
Fixes: 2fffb1c03056 ("tc: flower: Add matching on conntrack info")
|
|
|
ef51e0 |
Signed-off-by: Paul Blakey <paulb@nvidia.com>
|
|
|
ef51e0 |
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
|
|
|
ef51e0 |
---
|
|
|
ef51e0 |
tc/f_flower.c | 2 +-
|
|
|
ef51e0 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
ef51e0 |
|
|
|
ef51e0 |
diff --git a/tc/f_flower.c b/tc/f_flower.c
|
|
|
ef51e0 |
index 7f78195f..6d70b92a 100644
|
|
|
ef51e0 |
--- a/tc/f_flower.c
|
|
|
ef51e0 |
+++ b/tc/f_flower.c
|
|
|
ef51e0 |
@@ -2195,7 +2195,7 @@ static void flower_print_ct_label(struct rtattr *attr,
|
|
|
ef51e0 |
const unsigned char *str;
|
|
|
ef51e0 |
bool print_mask = false;
|
|
|
ef51e0 |
int data_len, i;
|
|
|
ef51e0 |
- SPRINT_BUF(out);
|
|
|
ef51e0 |
+ char out[128];
|
|
|
ef51e0 |
char *p;
|
|
|
ef51e0 |
|
|
|
ef51e0 |
if (!attr)
|
|
|
ef51e0 |
--
|
|
|
ef51e0 |
2.36.1
|
|
|
ef51e0 |
|