From 0cfd537e8020812ef02ce0e27b8b22a94d3820c3 Mon Sep 17 00:00:00 2001 From: Giuseppe Longo Date: Sat, 12 Oct 2013 11:21:52 +0200 Subject: nft: arp: fix possible string overflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This patch replaces strcat with strncat and strcpy with strncpy fixing possible string overflow. Based on the original patch: http://patchwork.ozlabs.org/patch/279672/ from Jaromír Končický via Jiri Popelka. Signed-off-by: Giuseppe Longo Signed-off-by: Pablo Neira Ayuso --- iptables/nft-arp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'iptables/nft-arp.c') diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c index 08f88145..17101369 100644 --- a/iptables/nft-arp.c +++ b/iptables/nft-arp.c @@ -459,7 +459,8 @@ nft_arp_print_firewall(struct nft_rule *r, unsigned int num, sprintf(buf, "%s", addr_to_dotted(&(fw.arp.src))); else sprintf(buf, "%s", addr_to_anyname(&(fw.arp.src))); - strcat(buf, mask_to_dotted(&(fw.arp.smsk))); + strncat(buf, mask_to_dotted(&(fw.arp.smsk)), + sizeof(buf) - strlen(buf) - 1); printf("-s %s ", buf); } @@ -483,7 +484,8 @@ after_devsrc: sprintf(buf, "%s", addr_to_dotted(&(fw.arp.tgt))); else sprintf(buf, "%s", addr_to_anyname(&(fw.arp.tgt))); - strcat(buf, mask_to_dotted(&(fw.arp.tmsk))); + strncat(buf, mask_to_dotted(&(fw.arp.tmsk)), + sizeof(buf) - strlen(buf) - 1); printf("-d %s ", buf); } -- cgit v1.2.3