diff options
| author | Thomas Haller <thaller@redhat.com> | 2016-08-14 09:44:53 (GMT) |
|---|---|---|
| committer | Thomas Haller <thaller@redhat.com> | 2016-08-14 09:46:19 (GMT) |
| commit | b3dfa79010dcb0f12d68903ba8fb8367d8bee0da (patch) | |
| tree | 579ca339eb5c6ed1fd74f91f51887f28607023a2 /lib/addr.c | |
| parent | 5e17c54a7536caca42bacef4a01cf33ce131de0d (diff) | |
| download | libnl-b3dfa79010dcb0f12d68903ba8fb8367d8bee0da.zip libnl-b3dfa79010dcb0f12d68903ba8fb8367d8bee0da.tar.gz libnl-b3dfa79010dcb0f12d68903ba8fb8367d8bee0da.tar.bz2 | |
nl-addr: avoid read-out-of-bound in nl_addr_fill_sockaddr()
https://github.com/thom311/libnl/issues/103
Signed-off-by: Thomas Haller <thaller@redhat.com>
Diffstat (limited to 'lib/addr.c')
| -rw-r--r-- | lib/addr.c | 16 |
1 files changed, 14 insertions, 2 deletions
@@ -707,8 +707,14 @@ int nl_addr_fill_sockaddr(const struct nl_addr *addr, struct sockaddr *sa, if (*salen < sizeof(*sai)) return -NLE_INVAL; + if (addr->a_len == 4) + memcpy(&sai->sin_addr, addr->a_addr, 4); + else if (addr->a_len != 0) + return -NLE_INVAL; + else + memset(&sai->sin_addr, 0, 4); + sai->sin_family = addr->a_family; - memcpy(&sai->sin_addr, addr->a_addr, 4); *salen = sizeof(*sai); } break; @@ -719,8 +725,14 @@ int nl_addr_fill_sockaddr(const struct nl_addr *addr, struct sockaddr *sa, if (*salen < sizeof(*sa6)) return -NLE_INVAL; + if (addr->a_len == 16) + memcpy(&sa6->sin6_addr, addr->a_addr, 16); + else if (addr->a_len != 0) + return -NLE_INVAL; + else + memset(&sa6->sin6_addr, 0, 16); + sa6->sin6_family = addr->a_family; - memcpy(&sa6->sin6_addr, addr->a_addr, 16); *salen = sizeof(*sa6); } break; |