diff options
| author | Sebastian Bixl <sebastianbixl@gmx.de> | 2017-10-15 20:34:01 (GMT) |
|---|---|---|
| committer | Thomas Haller <thaller@redhat.com> | 2017-10-23 09:01:35 (GMT) |
| commit | 6dfb40acd9b0b421b587f26840dfc072211976c2 (patch) | |
| tree | 77a96f4d0352d5d4063f37f600446a76d0bc848a /lib/route | |
| parent | 707af3ec7b4841812fce8cb19d20edab031c7a96 (diff) | |
| download | libnl-6dfb40acd9b0b421b587f26840dfc072211976c2.zip libnl-6dfb40acd9b0b421b587f26840dfc072211976c2.tar.gz libnl-6dfb40acd9b0b421b587f26840dfc072211976c2.tar.bz2 | |
route/vlan: fix memory corruption in rtnl_link_vlan_set_egress_map
If you set more than four entries for the vlan egress map a memory
corruption occurs because the reallocation does not reserve memory
for more than four.
Fixes: a7469ce758fac3631df6ce72eb3f89150070e7f8
https://github.com/thom311/libnl/pull/155
[thaller@redhat.com: squashed commits and updated commit message]
Diffstat (limited to 'lib/route')
| -rw-r--r-- | lib/route/link/vlan.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/route/link/vlan.c b/lib/route/link/vlan.c index 118d5a0..477c9af 100644 --- a/lib/route/link/vlan.c +++ b/lib/route/link/vlan.c @@ -589,7 +589,7 @@ int rtnl_link_vlan_set_egress_map(struct rtnl_link *link, uint32_t from, int to) int new_size = vi->vi_egress_size + 32; void *ptr; - ptr = realloc(vi->vi_egress_qos, new_size); + ptr = realloc(vi->vi_egress_qos, new_size * sizeof(struct vlan_map)); if (!ptr) return -NLE_NOMEM; |