batman-adv: check proto length before accessing proto string buffer
authorMarek Lindner <lindner_marek@yahoo.de>
Sat, 27 Apr 2013 08:22:28 +0000 (16:22 +0800)
committerAntonio Quartulli <ordex@autistici.org>
Thu, 9 May 2013 10:39:44 +0000 (12:39 +0200)
batadv_param_set_ra() strips the trailing '\n' from the supplied
string buffer without checking the length of the buffer first. This
patches avoids random memory access and associated potential
crashes.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
net/batman-adv/main.c

index 3e30a0f1b908b2872bcb6a13100306e0deda0c85..9c620cd3b5f718dbb1025ad7e053f01cbbc55a11 100644 (file)
@@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp)
        char *algo_name = (char *)val;
        size_t name_len = strlen(algo_name);
 
-       if (algo_name[name_len - 1] == '\n')
+       if (name_len > 0 && algo_name[name_len - 1] == '\n')
                algo_name[name_len - 1] = '\0';
 
        bat_algo_ops = batadv_algo_get(algo_name);