From: Mike Saal <msaal@qacafe.com>
Date: Wed, 26 Aug 2015 15:59:17 +0000 (-0400)
Subject: ss format bug
X-Git-Tag: v4.3.0~62
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4fcfb6bc71f39039271b9f00d4044a9a2a97a0a3;p=thirdparty%2Fiproute2.git

ss format bug

Hi:

I found a formatting bug in the 4.1.1 ss command. The following line was
incorrectly output due to passing a negative length to printf() when
displaying the local address. In this instance hostapd does a "bind to
device" on cdreth0 and then does a udp "in address any" port 67 bind.
Please note the whitespace between the '*' and ' %cdreth0:67'

    'udp UNCONN 0 0 ** %cdreth0:67* *:* users:(("hostapd",pid=19241,fd=5))'

Attached is my patch for the bug fix, it might be prudent to add more
guard code looking for negative length format codes.

Sincerely, Mike
---

diff --git a/misc/ss.c b/misc/ss.c
index 2f3496228..9efc3c850 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -1020,6 +1020,8 @@ static void inet_addr_print(const inet_prefix *a, int port, unsigned int ifindex
 	if (ifindex) {
 		ifname   = ll_index_to_name(ifindex);
 		est_len -= strlen(ifname) + 1;  /* +1 for percent char */
+		if (est_len < 0)
+			est_len = 0;
 	}
 
 	sock_addr_print_width(est_len, ap, ":", serv_width, resolve_service(port),