| Message ID | 20230918184631.16228-1-stephen@networkplumber.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 4d80122ae82aea86cb740b5202f6c3fde6183538 |
| Delegated to: | Stephen Hemminger |
| Headers | show |
| Series | [iproute2,1/2] bridge: fix potential snprintf overflow | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
Hello: This series was applied to iproute2/iproute2.git (main) by Stephen Hemminger <stephen@networkplumber.org>: On Mon, 18 Sep 2023 11:46:30 -0700 you wrote: > There is a theoretical snprintf overflow in bridge slave bitmask > print code found by CodeQL scan. > > Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> > --- > ip/iplink_bridge_slave.c | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) Here is the summary with links: - [iproute2,1/2] bridge: fix potential snprintf overflow https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=4d80122ae82a - [iproute2,2/2] ila: fix potential snprintf buffer overflow https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=e8a3fca81cd4 You are awesome, thank you!
diff --git a/ip/iplink_bridge_slave.c b/ip/iplink_bridge_slave.c index dc73c86574da..3821923b5da5 100644 --- a/ip/iplink_bridge_slave.c +++ b/ip/iplink_bridge_slave.c @@ -100,13 +100,20 @@ static void _bitmask2str(__u16 bitmask, char *dst, size_t dst_size, int len, i; for (i = 0, len = 0; bitmask; i++, bitmask >>= 1) { + int n; + if (bitmask & 0x1) { if (tbl[i]) - len += snprintf(dst + len, dst_size - len, "%s,", + n = snprintf(dst + len, dst_size - len, "%s,", tbl[i]); else - len += snprintf(dst + len, dst_size - len, "0x%x,", + n = snprintf(dst + len, dst_size - len, "0x%x,", (1 << i)); + + if (n < 0 || n >= dst_size - len) + break; + + len += n; } }
There is a theoretical snprintf overflow in bridge slave bitmask print code found by CodeQL scan. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> --- ip/iplink_bridge_slave.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)