| Message ID | 20230213032631.143810-1-sam@gentoo.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 890c599ec2e8905e7b8a433be3646d5d34901810 |
| Delegated to: | Stephen Hemminger |
| Headers | show |
| Series | ip: fix UB in strncpy (e.g. truncated ip route output) | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
Hello: This patch was applied to iproute2/iproute2.git (main) by Stephen Hemminger <stephen@networkplumber.org>: On Mon, 13 Feb 2023 03:26:31 +0000 you wrote: > Fix overlapping buffers passed to strncpy which is UB. format_host_rta_r writes > to the buffer passed to it, so hostname (derived from b1) & b1 partly overlap. > > This gets worse with sys-libs/glibc-2.37 where the ip route output can be truncated, > but it was UB anyway and you can see it occurring w/ glibc-2.36. > > Bug: https://lore.kernel.org/netdev/0011AC38-4823-4D0A-8580-B108D08959C2@gentoo.org/T/#u > Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30112 > Thanks-to: Doug Freed <dwfreed@mtu.edu> > Signed-off-by: Sam James <sam@gentoo.org> > > [...] Here is the summary with links: - ip: fix UB in strncpy (e.g. truncated ip route output) https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=890c599ec2e8 You are awesome, thank you!
diff --git a/ip/iproute.c b/ip/iproute.c index 0bab0fdf..a7cd9543 100644 --- a/ip/iproute.c +++ b/ip/iproute.c @@ -748,6 +748,7 @@ int print_route(struct nlmsghdr *n, void *arg) int ret; SPRINT_BUF(b1); + SPRINT_BUF(b2); if (n->nlmsg_type != RTM_NEWROUTE && n->nlmsg_type != RTM_DELROUTE) { fprintf(stderr, "Not a route: %08x %08x %08x\n", @@ -809,7 +810,7 @@ int print_route(struct nlmsghdr *n, void *arg) r->rtm_dst_len); } else { const char *hostname = format_host_rta_r(family, tb[RTA_DST], - b1, sizeof(b1)); + b2, sizeof(b2)); if (hostname) strncpy(b1, hostname, sizeof(b1) - 1); } @@ -832,7 +833,7 @@ int print_route(struct nlmsghdr *n, void *arg) r->rtm_src_len); } else { const char *hostname = format_host_rta_r(family, tb[RTA_SRC], - b1, sizeof(b1)); + b2, sizeof(b2)); if (hostname) strncpy(b1, hostname, sizeof(b1) - 1); }
Fix overlapping buffers passed to strncpy which is UB. format_host_rta_r writes to the buffer passed to it, so hostname (derived from b1) & b1 partly overlap. This gets worse with sys-libs/glibc-2.37 where the ip route output can be truncated, but it was UB anyway and you can see it occurring w/ glibc-2.36. Bug: https://lore.kernel.org/netdev/0011AC38-4823-4D0A-8580-B108D08959C2@gentoo.org/T/#u Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30112 Thanks-to: Doug Freed <dwfreed@mtu.edu> Signed-off-by: Sam James <sam@gentoo.org> --- ip/iproute.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)