From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Sven Eckelmann Date: Fri, 27 Jan 2017 15:10:44 +0100 Message-Id: <20170127141044.5317-1-sven@narfation.org> Subject: [B.A.T.M.A.N.] [PATCH] alfred: Avoid buffer overflow while querying ARP cache List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: b.a.t.m.a.n@lists.open-mesh.org The arpreq.arp_dev is a limited buffer (16 bytes). Avoid that more bytes from the interface name are copied into this buffer by switching from strcpy to strncpy. Fixes: c7da798113a2 ("alfred: IPv4 multicast distribution support.") Signed-off-by: Sven Eckelmann --- util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/util.c b/util.c index 84ab3af..ed83895 100644 --- a/util.c +++ b/util.c @@ -92,7 +92,9 @@ int ipv4_arp_request(struct interface *interface, const alfred_addr *addr, sin->sin_family = AF_INET; sin->sin_addr.s_addr = addr->ipv4.s_addr; - strcpy(arpreq.arp_dev, interface->interface); + strncpy(arpreq.arp_dev, interface->interface, sizeof(arpreq.arp_dev)); + arpreq.arp_dev[sizeof(arpreq.arp_dev) - 1] = '\0'; + if (ioctl(interface->netsock, SIOCGARP, &arpreq) < 0) return -1; -- 2.11.0