owner: Fix potential array out of bounds access

If the link target length exceeds 'sizeof(tmp)' bytes, readlink() will
return 'sizeof(tmp)'. Using this value as index is illegal.

Original update from Phil, for the conntrack-tools tree, which also has
a copy of this function.

Fixes: 6d085b22a8b5 ("table: support for the table owner flag")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/owner.c b/src/owner.c
index 2d98a2e9802856d025cb8dacf56bc7df28b8816b..20bed38b2a09f7742624702c028aed088ca00388 100644 (file)
--- a/src/owner.c
+++ b/src/owner.c
@@ -66,7 +66,7 @@ static char *portid2name(pid_t pid, uint32_t portid, unsigned long inode)
                        continue;
 
                rl = readlink(procname, tmp, sizeof(tmp));
-               if (rl <= 0 || rl > (ssize_t)sizeof(tmp))
+               if (rl <= 0 || rl >= (ssize_t)sizeof(tmp))
                        continue;
 
                tmp[rl] = 0;