Source: net-tools Version: 2.10-2 Severity: normal Tags: patch upstream fixed-upstream
Dear Maintainer, AX25_print() in lib/ax25.c and NETROM_print() in lib/netrom.c format a callsign into "static char buff[8]". An AX.25 callsign is up to six characters plus an SSID from 0 to 15, so the longest form, for example F6BVP-12 or N0CALL-15, needs 9 or 10 bytes with the terminating NUL. Any callsign of five or six letters with a two-digit SSID overflows the buffer by one or two bytes. It is hit simply by running ifconfig (or netstat, route, arp) on a host with an AX.25 or NET/ROM interface configured with such a callsign: ax0: flags=67<UP,BROADCAST,RUNNING> mtu 253 ax25 F6BVP-10 txqueuelen 10 (AMPR AX.25) With the hardening flags of the current Ubuntu build (_FORTIFY_SOURCE=3), ifconfig aborts: $ ifconfig ax0 *** buffer overflow detected ***: terminated With the Debian builds (checked on 2.10-1.3 armhf and arm64, 2.10-0.1+deb12u2 arm64 and i386, 1.60+git20181103.0eebece-1+deb11u2 armhf) the output looks right but one or two bytes past the end of the static buffer are silently overwritten. The bug is present in every version I looked at: 1.60+git20180626, 1.60+git20181103, 2.10, and still in 2.10-2 in sid. It is fixed upstream: c084d1fea5de "Prevent overflow in ax25 and netrom" 139f5d8 "Fix sprintf that should be snprintf" (c084d1f used sprintf() with a size argument, which does not build) https://www.google.com/url?q=https://github.com/ecki/net-tools/commit/c084d1fea5de0f6dcaed4a59b38a4140bd2e9f13&source=gmail&ust=1792170184332000&sa=E The attached patch combines both commits in a form ready for debian/patches (DEP-3 header). It applies on top of the existing series of 2.10-2, 2.10-1.3, 2.10-0.1+deb12u2 and 1.60+git20181103.0eebece-1+deb11u2 without change. I rebuilt the package with it on eight amateur radio nodes (Debian 11, 12 and 13, Raspberry Pi OS, Ubuntu 20.04, 24.04 and 26.04; amd64, i386, armhf and arm64); ifconfig, netstat and route display the AX.25, NET/ROM and ROSE interfaces correctly and the Ubuntu abort is gone. As the fix is small and the code is reachable on every host running an AX.25 node, it may also be worth considering for trixie and bookworm through a stable update. Thanks, Bernard Pidoux, F6BVP
From c084d1fea5de0f6dcaed4a59b38a4140bd2e9f13 Mon Sep 17 00:00:00 2001 From: Bernd Eckenfels <[email protected]> Date: Sat, 16 Aug 2025 22:29:13 +0200 Subject: [PATCH] Prevent overflow in ax25 and netrom Fixes sourceforge #48 Thanks to Bernard Pidoux. Also includes upstream 139f5d8 (Fix sprintf that should be snprintf). Origin: upstream, https://github.com/ecki/net-tools/commit/c084d1fea5de0f6dcaed4a59b38a4140bd2e9f13 --- diff --git a/lib/ax25.c b/lib/ax25.c index 80a82c4..ab40e00 100644 --- a/lib/ax25.c +++ b/lib/ax25.c @@ -47,9 +47,10 @@ static char AX25_errmsg[128]; extern struct aftype ax25_aftype; +// align with NETROM_orint static const char *AX25_print(const char *ptr) { - static char buff[8]; + static char buff[10]; // N0CALL-15 int i; for (i = 0; i < 6; i++) { @@ -58,9 +59,14 @@ static const char *AX25_print(const char *ptr) buff[i] = '\0'; } buff[6] = '\0'; + + // add SSID i = ((ptr[6] & 0x1E) >> 1); - if (i != 0) - sprintf(&buff[strlen(buff)], "-%d", i); + if (i != 0) { + int l = strlen(buff); + snprintf(&buff[l], sizeof(buff)-l, "-%d", i); + } + return (buff); } diff --git a/lib/netrom.c b/lib/netrom.c index 6bcde2d..309e7cb 100644 --- a/lib/netrom.c +++ b/lib/netrom.c @@ -54,7 +54,7 @@ extern struct aftype netrom_aftype; static const char *NETROM_print(const char *ptr) { - static char buff[8]; + static char buff[10]; // N0CALL-15\0 int i; for (i = 0; i < 6; i++) { @@ -63,9 +63,15 @@ static const char *NETROM_print(const char *ptr) buff[i] = '\0'; } buff[6] = '\0'; + + // add SSID i = ((ptr[6] & 0x1E) >> 1); if (i != 0) - sprintf(&buff[strlen(buff)], "-%d", i); + { + int l = strlen(buff); // 0-6 + snprintf(&buff[l],sizeof(buff)-l, "-%d", i); + } + return (buff); }
