diff mbox series

[iproute2-next,1/1] tc: flower: Fix buffer overflow on large labels

Message ID 20211205132025.15596-1-paulb@nvidia.com (mailing list archive)
State Accepted
Delegated to: Stephen Hemminger
Headers show
Series [iproute2-next,1/1] tc: flower: Fix buffer overflow on large labels | expand

Checks

Context Check Description
netdev/tree_selection success Not a local patch

Commit Message

Paul Blakey Dec. 5, 2021, 1:20 p.m. UTC 
Buffer is 64bytes, but label printing can take 66bytes printing
in hex, and will overflow when setting the string delimiter ('\0').

Fix that by increasing the print buffer size.

Example of overflowing ct_label:
ct_label 11111111111111111111111111111111/11111111111111111111111111111111

Fixes: 2fffb1c03056 ("tc: flower: Add matching on conntrack info")
Signed-off-by: Paul Blakey <paulb@nvidia.com>
---
 tc/f_flower.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/tc/f_flower.c b/tc/f_flower.c
index 7f78195f..6d70b92a 100644
--- a/tc/f_flower.c
+++ b/tc/f_flower.c
@@ -2195,7 +2195,7 @@  static void flower_print_ct_label(struct rtattr *attr,
 	const unsigned char *str;
 	bool print_mask = false;
 	int data_len, i;
-	SPRINT_BUF(out);
+	char out[128];
 	char *p;
 
 	if (!attr)