diff options
| author | Phil Sutter <phil@nwl.cc> | 2018-09-10 23:35:14 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2018-09-13 10:47:52 +0200 |
| commit | e6f986762667ee2b2d61e7978d460f28916158a3 (patch) | |
| tree | bb082a4e8af6fec2b85ec17e91c46352b18fa5b3 /libiptc | |
| parent | 4144571f87c094471419ef59e8bb89ef33cd1365 (diff) | |
libiptc: Avoid side-effect in memset() calls
These calls to memset() are passed a length argument which exceeds
t->target.u.user.name's length by one byte and hence overwrite
t->target.u.user.revision as well (relying upon no padding to happen
between both).
Avoid this obscure behaviour by passing the correct field size and
explicitly overwriting 'revision' field.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'libiptc')
| -rw-r--r-- | libiptc/libiptc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c index a6e70571..6eacdddd 100644 --- a/libiptc/libiptc.c +++ b/libiptc/libiptc.c @@ -1115,8 +1115,9 @@ static inline int iptcc_compile_rule (struct xtc_handle *h, STRUCT_REPLACE *repl STRUCT_STANDARD_TARGET *t; t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry); /* memset for memcmp convenience on delete/replace */ - memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN); + memset(t->target.u.user.name, 0, XT_EXTENSION_MAXNAMELEN); strcpy(t->target.u.user.name, STANDARD_TARGET); + t->target.u.user.revision = 0; /* Jumps can only happen to builtin chains, so we * can safely assume that they always have a header */ t->verdict = r->jump->head_offset + IPTCB_CHAIN_START_SIZE; @@ -1675,8 +1676,9 @@ iptcc_standard_map(struct rule_head *r, int verdict) return 0; } /* memset for memcmp convenience on delete/replace */ - memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN); + memset(t->target.u.user.name, 0, XT_EXTENSION_MAXNAMELEN); strcpy(t->target.u.user.name, STANDARD_TARGET); + t->target.u.user.revision = 0; t->verdict = verdict; r->type = IPTCC_R_STANDARD; |