diff options
| author | Patrick McHardy <kaber@trash.net> | 2010-04-08 11:35:47 (GMT) |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2010-04-08 11:35:47 (GMT) |
| commit | 3d91c1a848c812e0e66e7e57f076667822cb460e (patch) | |
| tree | cd5c6a16e0f48f99045e032a4ceb8946ec9d7ef0 /net/netfilter/ipvs/ip_vs_proto_ah_esp.c | |
| parent | 02e4eb75912a5c8babccc1acdc9cc913989be04e (diff) | |
| download | linux-fsl-qoriq-3d91c1a848c812e0e66e7e57f076667822cb460e.tar.xz | |
IPVS: fix potential stack overflow with overly long protocol names
When protocols use very long names, the sprintf calls might overflow
the on-stack buffer. No protocol in the kernel does this however.
Print the protocol name in the pr_debug statement directly to avoid
this.
Based on patch by Zhitong Wang <zhitong.wangzt@alibaba-inc.com>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net/netfilter/ipvs/ip_vs_proto_ah_esp.c')
| -rw-r--r-- | net/netfilter/ipvs/ip_vs_proto_ah_esp.c | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c index c30b43c..1892dfc 100644 --- a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c +++ b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c @@ -136,12 +136,11 @@ ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb, ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph); if (ih == NULL) - sprintf(buf, "%s TRUNCATED", pp->name); + sprintf(buf, "TRUNCATED"); else - sprintf(buf, "%s %pI4->%pI4", - pp->name, &ih->saddr, &ih->daddr); + sprintf(buf, "%pI4->%pI4", &ih->saddr, &ih->daddr); - pr_debug("%s: %s\n", msg, buf); + pr_debug("%s: %s %s\n", msg, pp->name, buf); } #ifdef CONFIG_IP_VS_IPV6 @@ -154,12 +153,11 @@ ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb, ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph); if (ih == NULL) - sprintf(buf, "%s TRUNCATED", pp->name); + sprintf(buf, "TRUNCATED"); else - sprintf(buf, "%s %pI6->%pI6", - pp->name, &ih->saddr, &ih->daddr); + sprintf(buf, "%pI6->%pI6", &ih->saddr, &ih->daddr); - pr_debug("%s: %s\n", msg, buf); + pr_debug("%s: %s %s\n", msg, pp->name, buf); } #endif |