[PATCH iproute2-next] ip: ipmaddr.c: Fix possible integer underflow in read_igmp()

[PATCH iproute2-next] ip: ipmaddr.c: Fix possible integer underflow in read_igmp()

[Anton Moryakov]

Static analyzer pointed out a potential error:

	Possible integer underflow: left operand is tainted. An integer underflow 
	may occur due to arithmetic operation (unsigned subtraction) between variable 
	'len' and value '1', when 'len' is tainted { [0, 18446744073709551615] }

The fix adds a check for 'len == 0' before accessing the last character of
the name, and skips the current line in such cases to avoid the underflow.

Reported-by: SVACE static analyzer
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
---
 ip/ipmaddr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ip/ipmaddr.c b/ip/ipmaddr.c
index 2418b303..2feb916a 100644
--- a/ip/ipmaddr.c
+++ b/ip/ipmaddr.c
@@ -150,6 +150,8 @@ static void read_igmp(struct ma_info **result_p)
 
 			sscanf(buf, "%d%s", &m.index, m.name);
 			len = strlen(m.name);
+			if(len == 0)
+				continue;
 			if (m.name[len - 1] == ':')
 				m.name[len - 1] = '\0';
 			continue;
-- 
2.39.2

Re: [PATCH iproute2-next] ip: ipmaddr.c: Fix possible integer underflow in read_igmp()

[Stephen Hemminger]

On Sat, 19 Jul 2025 18:57:05 +0300
Anton Moryakov <ant.v.moryakov@gmail.com> wrote:

> Static analyzer pointed out a potential error:
> 
> 	Possible integer underflow: left operand is tainted. An integer underflow 
> 	may occur due to arithmetic operation (unsigned subtraction) between variable 
> 	'len' and value '1', when 'len' is tainted { [0, 18446744073709551615] }
> 
> The fix adds a check for 'len == 0' before accessing the last character of
> the name, and skips the current line in such cases to avoid the underflow.
> 
> Reported-by: SVACE static analyzer
> Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
> ---
>  ip/ipmaddr.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/ip/ipmaddr.c b/ip/ipmaddr.c
> index 2418b303..2feb916a 100644
> --- a/ip/ipmaddr.c
> +++ b/ip/ipmaddr.c
> @@ -150,6 +150,8 @@ static void read_igmp(struct ma_info **result_p)
>  
>  			sscanf(buf, "%d%s", &m.index, m.name);
>  			len = strlen(m.name);
> +			if(len == 0)
> +				continue;

Need to follow kernel coding style, need space here.
	if (len == 0)
not
	if(len == 0)