aboutsummaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorMarek Lindner <lindner_marek@yahoo.de>2013-04-27 16:22:28 +0800
committerAntonio Quartulli <ordex@autistici.org>2013-05-09 12:39:44 +0200
commit293c9c1cef6be46ad72b528fa79c3ff034551fe0 (patch)
tree2ecf02ef21613e3a69cb0ebf333ad1ba8ff68665 /net
parent4f924b2aa4d3cb30f07e57d6b608838edcbc0d88 (diff)
batman-adv: check proto length before accessing proto string buffer
batadv_param_set_ra() strips the trailing '\n' from the supplied string buffer without checking the length of the buffer first. This patches avoids random memory access and associated potential crashes. Reported-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
Diffstat (limited to 'net')
-rw-r--r--net/batman-adv/main.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 3e30a0f1b90..9c620cd3b5f 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp)
char *algo_name = (char *)val;
size_t name_len = strlen(algo_name);
- if (algo_name[name_len - 1] == '\n')
+ if (name_len > 0 && algo_name[name_len - 1] == '\n')
algo_name[name_len - 1] = '\0';
bat_algo_ops = batadv_algo_get(algo_name);