From: Daniel Wagner <[email protected]>
ifr_name is a null terminated buffer, therefore we should
only copy IFNAMSIZ - 1 characters.
Reported by coverty.
---
tools/tap-test.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/tap-test.c b/tools/tap-test.c
index 1074c9c..fdc098a 100644
--- a/tools/tap-test.c
+++ b/tools/tap-test.c
@@ -49,7 +49,7 @@ static int inet_ifup(const char *ifname)
return -errno;
memset(&ifr, 0, sizeof(ifr));
- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
+ strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name) - 1);
if (ioctl(sk, SIOCGIFFLAGS, &ifr) < 0) {
err = -errno;
@@ -89,7 +89,7 @@ static int create_tap(const char *ifname)
memset(&ifr, 0, sizeof(ifr));
ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
+ strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name) - 1);
if (ioctl(fd, TUNSETIFF, (void *) &ifr) < 0) {
perror("Failed to set TUN/TAP interface");
--
1.8.4.474.g128a96c
_______________________________________________
connman mailing list
[email protected]
https://lists.connman.net/mailman/listinfo/connman
