From 6c7c716bec3b3302c2212c9273c33f9640de8206 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Gr=C3=B6ber?= Date: Wed, 24 Jun 2020 15:29:59 +0200 Subject: conntrack: Replace strncpy with snprintf to improve null byte handling MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We currently use strncpy in a bunch of places which has this weird quirk where it doesn't write a terminating null byte if the input string is >= the max length. To mitigate this we write a null byte to the last character manually. While this works it is easy to forget. Instead we should just be using snprintf which has more sensible behaviour as it always writes a null byte even when truncating the string. Signed-off-by: Daniel Gröber Signed-off-by: Pablo Neira Ayuso --- src/expect/parse_mnl.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) (limited to 'src/expect/parse_mnl.c') diff --git a/src/expect/parse_mnl.c b/src/expect/parse_mnl.c index 091a8ae..fb4bdb7 100644 --- a/src/expect/parse_mnl.c +++ b/src/expect/parse_mnl.c @@ -10,6 +10,7 @@ */ #include "internal/internal.h" +#include #include static int nlmsg_parse_expection_attr_cb(const struct nlattr *attr, void *data) @@ -139,10 +140,8 @@ int nfexp_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_expect *exp) set_bit(ATTR_EXP_FLAGS, exp->set); } if (tb[CTA_EXPECT_HELP_NAME]) { - strncpy(exp->helper_name, - mnl_attr_get_str(tb[CTA_EXPECT_HELP_NAME]), - NFCT_HELPER_NAME_MAX); - exp->helper_name[NFCT_HELPER_NAME_MAX - 1] = '\0'; + snprintf(exp->helper_name, NFCT_HELPER_NAME_MAX, "%s", + mnl_attr_get_str(tb[CTA_EXPECT_HELP_NAME])); set_bit(ATTR_EXP_HELPER_NAME, exp->set); } if (tb[CTA_EXPECT_CLASS]) { @@ -153,9 +152,11 @@ int nfexp_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_expect *exp) nfexp_nlmsg_parse_nat(nfg, tb[CTA_EXPECT_NAT], exp); if (tb[CTA_EXPECT_FN]) { - strncpy(exp->expectfn, mnl_attr_get_payload(tb[CTA_EXPECT_FN]), - __NFCT_EXPECTFN_MAX); - exp->expectfn[__NFCT_EXPECTFN_MAX - 1] = '\0'; + int len = mnl_attr_get_payload_len(tb[CTA_EXPECT_FN]); + /* the kernel doesn't impose a max length on this str */ + assert(len <= __NFCT_EXPECTFN_MAX); + snprintf(exp->expectfn, __NFCT_EXPECTFN_MAX, "%s", + (char *)mnl_attr_get_payload(tb[CTA_EXPECT_FN])); set_bit(ATTR_EXP_FN, exp->set); } -- cgit v1.2.3