diff options
| author | Daniel Gröber <dxld@darkboxed.org> | 2020-06-24 15:29:59 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-07-01 12:54:06 +0200 |
| commit | 6c7c716bec3b3302c2212c9273c33f9640de8206 (patch) | |
| tree | f6d46c7cbba64c9290e6d50312c79827a3a237ef /src/conntrack | |
| parent | 16756ca4edb55cdd8c88f4e123ffa6b94501d050 (diff) | |
conntrack: Replace strncpy with snprintf to improve null byte handling
We currently use strncpy in a bunch of places which has this weird quirk
where it doesn't write a terminating null byte if the input string is >=
the max length. To mitigate this we write a null byte to the last character
manually.
While this works it is easy to forget. Instead we should just be using
snprintf which has more sensible behaviour as it always writes a null byte
even when truncating the string.
Signed-off-by: Daniel Gröber <dxld@darkboxed.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/conntrack')
| -rw-r--r-- | src/conntrack/copy.c | 4 | ||||
| -rw-r--r-- | src/conntrack/parse_mnl.c | 5 | ||||
| -rw-r--r-- | src/conntrack/setter.c | 3 |
3 files changed, 5 insertions, 7 deletions
diff --git a/src/conntrack/copy.c b/src/conntrack/copy.c index eca202e..402f994 100644 --- a/src/conntrack/copy.c +++ b/src/conntrack/copy.c @@ -427,8 +427,8 @@ static void copy_attr_repl_off_aft(struct nf_conntrack *dest, static void copy_attr_helper_name(struct nf_conntrack *dest, const struct nf_conntrack *orig) { - strncpy(dest->helper_name, orig->helper_name, NFCT_HELPER_NAME_MAX); - dest->helper_name[NFCT_HELPER_NAME_MAX-1] = '\0'; + snprintf(dest->helper_name, NFCT_HELPER_NAME_MAX, "%s", + orig->helper_name); } static void copy_attr_zone(struct nf_conntrack *dest, diff --git a/src/conntrack/parse_mnl.c b/src/conntrack/parse_mnl.c index 515deff..3cbfc6a 100644 --- a/src/conntrack/parse_mnl.c +++ b/src/conntrack/parse_mnl.c @@ -690,9 +690,8 @@ nfct_parse_helper(const struct nlattr *attr, struct nf_conntrack *ct) if (!tb[CTA_HELP_NAME]) return 0; - strncpy(ct->helper_name, mnl_attr_get_str(tb[CTA_HELP_NAME]), - NFCT_HELPER_NAME_MAX); - ct->helper_name[NFCT_HELPER_NAME_MAX-1] = '\0'; + snprintf(ct->helper_name, NFCT_HELPER_NAME_MAX, "%s", + mnl_attr_get_str(tb[CTA_HELP_NAME])); set_bit(ATTR_HELPER_NAME, ct->head.set); if (!tb[CTA_HELP_INFO]) diff --git a/src/conntrack/setter.c b/src/conntrack/setter.c index 7b96936..3a293b0 100644 --- a/src/conntrack/setter.c +++ b/src/conntrack/setter.c @@ -389,8 +389,7 @@ set_attr_repl_off_aft(struct nf_conntrack *ct, const void *value, size_t len) static void set_attr_helper_name(struct nf_conntrack *ct, const void *value, size_t len) { - strncpy(ct->helper_name, value, NFCT_HELPER_NAME_MAX); - ct->helper_name[NFCT_HELPER_NAME_MAX-1] = '\0'; + snprintf(ct->helper_name, NFCT_HELPER_NAME_MAX, "%s", (char *)value); } static void |