[PATCH iproute2 1/2] ss: validate sscanf() return value in packet_show_line()

[Prabhakar Pujeri <prabhakar.pujeri@dell.com>]

The /proc/net/packet fallback parser never checks the return value of
sscanf().  On a malformed or truncated line some of the output
variables (type, prot, iface, state, rq, uid, ino) stay
uninitialized and garbage values are used both for type based
filtering and for the printed socket state.

Require all eight fields to be converted before using the values and
return -1 on failure, which makes generic_record_read() stop
processing, the same way tcp_show_line() bails out on a malformed
/proc/net/tcp line.

Fixes: aba5acdfdb34 ("(Logical change 1.3)")
Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
---
 misc/ss.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c
index 26520cee..098eed27 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -4922,10 +4922,11 @@ static int packet_show_line(char *buf, const struct filter *f, int fam)
 	struct sockstat stat = {};
 	int type, prot, iface, state, rq, uid, ino;
 
-	sscanf(buf, "%llx %*d %d %x %d %d %u %u %u",
+	if (sscanf(buf, "%llx %*d %d %x %d %d %u %u %u",
 			&sk,
 			&type, &prot, &iface, &state,
-			&rq, &uid, &ino);
+			&rq, &uid, &ino) != 8)
+		return -1;
 
 	if (type == SOCK_RAW && !(f->dbs & (1<<PACKET_R_DB)))
 		return 0;
-- 
2.55.0