Fix memcpy overwrite in iproute.c because of bits vs. bytes confusion

diff --git a/ChangeLog b/ChangeLog
index 0a2d7f2d01280467d5c6dedf39d43f792bc8ca63..4d5bd412eb03f7d296e1a1c32481f4c46de962eb 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,8 @@
 2005-10-12  Stephen Hemminger  <shemminger@osdl.org>
 
        * Add more CBQ examples from Fedora Core
-
+       * Fix buffer overrun in iproute because of bits vs. bytes confusion
+       
 2005-10-12  Jamal Hadi Salim <hadi@znyx.com>
 
        * Fix ip rule flush, need to reopen rtnl

diff --git a/ip/iproute.c b/ip/iproute.c
index c8c32873d9bf8e6befdce1974f3ea6aec31914e1..a43c09e6cba6a82de0a45e527780e19ff2e9befa 100644 (file)
--- a/ip/iproute.c
+++ b/ip/iproute.c
@@ -216,13 +216,13 @@ int print_route(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
                memset(&via, 0, sizeof(via));
                via.family = r->rtm_family;
                if (tb[RTA_GATEWAY])
-                       memcpy(&via.data, RTA_DATA(tb[RTA_GATEWAY]), host_len);
+                       memcpy(&via.data, RTA_DATA(tb[RTA_GATEWAY]), host_len/8);
        }
        if (filter.rprefsrc.bitlen>0) {
                memset(&prefsrc, 0, sizeof(prefsrc));
                prefsrc.family = r->rtm_family;
                if (tb[RTA_PREFSRC])
-                       memcpy(&prefsrc.data, RTA_DATA(tb[RTA_PREFSRC]), host_len);
+                       memcpy(&prefsrc.data, RTA_DATA(tb[RTA_PREFSRC]), host_len/8);
        }
 
        if (filter.rdst.family && inet_addr_match(&dst, &filter.rdst, filter.rdst.bitlen))