]> git.ipfire.org Git - thirdparty/hostap.git/commitdiff
nl80211: Fix RTM NEW/DELLINK IFLA_IFNAME copy for maximum ifname length
authorOuden <Ouden.Biz@gmail.com>
Wed, 18 Mar 2020 09:58:37 +0000 (17:58 +0800)
committerJouni Malinen <j@w1.fi>
Sat, 21 Mar 2020 15:12:29 +0000 (17:12 +0200)
If the kernel rtm_newlink or rtm_dellink send the maximum length of
ifname (IFNAMSIZ), the event handlers in
wpa_driver_nl80211_event_rtm_addlink() and
wpa_driver_nl80211_event_rtm_dellink() did not copy the IFLA_IFNAME
value. Because the RTA_PAYLOAD (IFLA_IFNAME) length already includes the
NULL termination, that equals the IFNAMSIZ.

Fix the condition when IFNAME reach maximum size.

Signed-off-by: Ouden <Ouden.Biz@gmail.com>
src/drivers/driver_nl80211.c

index efcd69ad2cb87741b6038b19155ef53cbfcff891..c071cc0e02c35b96c121c553f0627755c0e16002 100644 (file)
@@ -1047,7 +1047,7 @@ static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
        while (RTA_OK(attr, attrlen)) {
                switch (attr->rta_type) {
                case IFLA_IFNAME:
-                       if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
+                       if (RTA_PAYLOAD(attr) > IFNAMSIZ)
                                break;
                        os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
                        ifname[RTA_PAYLOAD(attr)] = '\0';
@@ -1222,7 +1222,7 @@ static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
        while (RTA_OK(attr, attrlen)) {
                switch (attr->rta_type) {
                case IFLA_IFNAME:
-                       if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
+                       if (RTA_PAYLOAD(attr) > IFNAMSIZ)
                                break;
                        os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
                        ifname[RTA_PAYLOAD(attr)] = '\0';