RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 10:17:35 +00:00
Code Issues Activity Actions

Userland: Prefer strlcpy over strncpy in ifconfig, fixes off-by-one

Browse source 
A malicious caller of ifconfig could have caused the ifr_name field to
lack NUL-termination. I don't think this was an actual problem, though, as
the Kernel always forces NUL-termination by overwriting ifr_name's last byte
with NUL.

However, it feels better to do it properly.
This commit is contained in:
Ben Wiederhake 2020-08-23 13:35:07 +02:00 • committed by Andreas Kling
parent 46b04a79e5
commit 5c1a72f0ef
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/ifconfig.cpp
View file

@ -116,7 +116,7 @@ int main(int argc, char** argv)
struct ifreq ifr; struct ifreq ifr;
memset(&ifr, 0, sizeof(ifr)); memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, ifname.characters(), IFNAMSIZ); strlcpy(ifr.ifr_name, ifname.characters(), IFNAMSIZ);
ifr.ifr_addr.sa_family = AF_INET; ifr.ifr_addr.sa_family = AF_INET;
((sockaddr_in&)ifr.ifr_addr).sin_addr.s_addr = address.value().to_in_addr_t(); ((sockaddr_in&)ifr.ifr_addr).sin_addr.s_addr = address.value().to_in_addr_t();
@ -144,7 +144,7 @@ int main(int argc, char** argv)
struct ifreq ifr; struct ifreq ifr;
memset(&ifr, 0, sizeof(ifr)); memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, ifname.characters(), IFNAMSIZ); strlcpy(ifr.ifr_name, ifname.characters(), IFNAMSIZ);
ifr.ifr_netmask.sa_family = AF_INET; ifr.ifr_netmask.sa_family = AF_INET;
((sockaddr_in&)ifr.ifr_netmask).sin_addr.s_addr = address.value().to_in_addr_t(); ((sockaddr_in&)ifr.ifr_netmask).sin_addr.s_addr = address.value().to_in_addr_t();