From: Daniel Wagner <[email protected]>
ifr_name is a null terminated buffer, therefore we should
only copy IFNAMSIZ - 1 characters.
Reported by coverty.
---
src/inet.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/inet.c b/src/inet.c
index 8f204b7..1c2c313 100644
--- a/src/inet.c
+++ b/src/inet.c
@@ -203,7 +203,7 @@ int connman_inet_ifindex(const char *name)
return -1;
memset(&ifr, 0, sizeof(ifr));
- strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));
+ strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name) - 1);
err = ioctl(sk, SIOCGIFINDEX, &ifr);
@@ -336,7 +336,7 @@ int connman_inet_ifdown(int index)
}
memset(&addr_ifr, 0, sizeof(addr_ifr));
- memcpy(&addr_ifr.ifr_name, &ifr.ifr_name, sizeof(ifr.ifr_name));
+ memcpy(&addr_ifr.ifr_name, &ifr.ifr_name, sizeof(ifr.ifr_name) - 1);
addr = (struct sockaddr_in *)&addr_ifr.ifr_addr;
addr->sin_family = AF_INET;
if (ioctl(sk, SIOCSIFADDR, &addr_ifr) < 0)
@@ -1196,7 +1196,7 @@ int connman_inet_setup_tunnel(char *tunnel, int mtu)
goto done;
memset(&ifr, 0, sizeof(ifr));
- strncpy(ifr.ifr_name, tunnel, IFNAMSIZ);
+ strncpy(ifr.ifr_name, tunnel, IFNAMSIZ - 1);
err = ioctl(sk, SIOCGIFFLAGS, &ifr);
if (err)
goto done;
--
1.8.4.474.g128a96c
_______________________________________________
connman mailing list
[email protected]
https://lists.connman.net/mailman/listinfo/connman
