iptunnel: sanitize copying tunnel name

Since p->name is only IFNAMSIZ bytes, do not copy more than IFNAMSIZ - 1
bytes into it so there remains at least a single null byte in the end.

Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/ip/iptunnel.c b/ip/iptunnel.c
index 3b46a1593d2b070ee51475ac2f85f810f7a4bc9f..b377a5b48f5010e7719e0ebbb281f8b6d9eb49ee 100644 (file)
--- a/ip/iptunnel.c
+++ b/ip/iptunnel.c
@@ -175,7 +175,7 @@ static int parse_args(int argc, char **argv, int cmd, struct ip_tunnel_parm *p)
                                usage();
                        if (p->name[0])
                                duparg2("name", *argv);
-                       strncpy(p->name, *argv, IFNAMSIZ);
+                       strncpy(p->name, *argv, IFNAMSIZ - 1);
                        if (cmd == SIOCCHGTUNNEL && count == 0) {
                                struct ip_tunnel_parm old_p;
                                memset(&old_p, 0, sizeof(old_p));