batman-adv/patches/0003-batman-adv-check-proto-length-before-accessing-proto.patch

   1 From aa7d19a5b97fe48657e075e8e4d130bd6916551e Mon Sep 17 00:00:00 2001
   2 From: Marek Lindner <lindner_marek@yahoo.de>
   3 Date: Sat, 27 Apr 2013 16:22:28 +0800
   4 Subject: [PATCH 03/10] batman-adv: check proto length before accessing proto
   5  string buffer
   6
   7 batadv_param_set_ra() strips the trailing '\n' from the supplied
   8 string buffer without checking the length of the buffer first. This
   9 patches avoids random memory access and associated potential
  10 crashes.
  11
  12 Reported-by: Sasha Levin <sasha.levin@oracle.com>
  13 Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
  14 ---
  15  main.c |    2 +-
  16  1 file changed, 1 insertion(+), 1 deletion(-)
  17
  18 diff --git a/main.c b/main.c
  19 index 3e30a0f..9c620cd 100644
  20 --- a/main.c
  21 +++ b/main.c
  22 @@ -475,7 +475,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp)
  23         char *algo_name = (char *)val;
  24         size_t name_len = strlen(algo_name);
  25
  26 -       if (algo_name[name_len - 1] == '\n')
  27 +       if (name_len > 0 && algo_name[name_len - 1] == '\n')
  28                 algo_name[name_len - 1] = '\0';
  29
  30         bat_algo_ops = batadv_algo_get(algo_name);
  31 --
  32 1.7.10.4
  33