[PATCH iproute2 2/2] ss: validate sscanf() return value in netlink_show()

[Prabhakar Pujeri <prabhakar.pujeri@dell.com>]

The /proc/net/netlink fallback loop never checks the return value of
sscanf().  On a malformed or truncated line the output variables
(sk, prot, pid, groups, rq, wq, cb) stay uninitialized and garbage
values are passed on to netlink_show_one() and printed as socket
state.

Require all eight fields to be converted before using the values and
stop the read loop on failure, consistent with the other /proc
parsers in ss.c.

Fixes: aba5acdfdb34 ("(Logical change 1.3)")
Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
---
 misc/ss.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c
index 098eed27..7d9c5e91 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -5299,9 +5299,10 @@ static int netlink_show(struct filter *f)
 	}
 
 	while (fgets(buf, sizeof(buf), fp)) {
-		sscanf(buf, "%llx %d %d %x %d %d %llx %d",
-		       &sk,
-		       &prot, &pid, &groups, &rq, &wq, &cb, &rc);
+		if (sscanf(buf, "%llx %d %d %x %d %d %llx %d",
+			   &sk,
+			   &prot, &pid, &groups, &rq, &wq, &cb, &rc) != 8)
+			break;
 
 		netlink_show_one(f, prot, pid, groups, 0, 0, 0, rq, wq, sk, cb);
 	}
-- 
2.55.0