Bug#526329: iproute: Segfault on garbage lladdr

On tor, 2009-04-30 at 14:32 +0100, Timothy Baldwin wrote:
> Package: iproute
> Version: 20090324-1
> Severity: minor
>
>
> $ ip link set eth0 address help
> "help" is invalid lladdr.
> Segmentation fault
>
> Desipte the invalid command line arguments it shouldn't crash.
>

Callers need to check return value from ll_addr_a2n(). Patch below.

Signed-off-by: Andreas Henriksson <andreas@fatal.se>

diff --git a/ip/iplink.c b/ip/iplink.c
index 18249ca806102fefe2e3b9367a818cdf06f8204c..3e3b877ac4bfa25483a01de39f6479d5b0decc0d 100644 (file)
--- a/ip/iplink.c
+++ b/ip/iplink.c
@@ -200,11 +200,15 @@ int iplink_parse(int argc, char **argv, struct iplink_req *req,
                } else if (matches(*argv, "address") == 0) {
                        NEXT_ARG();
                        len = ll_addr_a2n(abuf, sizeof(abuf), *argv);
+                       if (len < 0)
+                               return -1;
                        addattr_l(&req->n, sizeof(*req), IFLA_ADDRESS, abuf, len);
                } else if (matches(*argv, "broadcast") == 0 ||
                                strcmp(*argv, "brd") == 0) {
                        NEXT_ARG();
                        len = ll_addr_a2n(abuf, sizeof(abuf), *argv);
+                       if (len < 0)
+                               return -1;
                        addattr_l(&req->n, sizeof(*req), IFLA_BROADCAST, abuf, len);
                } else if (matches(*argv, "txqueuelen") == 0 ||
                                strcmp(*argv, "qlen") == 0 ||