From: shemminger <shemminger>
Date: Wed, 12 Oct 2005 22:49:50 +0000 (+0000)
Subject: Fix memcpy overwrite in iproute.c because of bits vs. bytes confusion
X-Git-Tag: ss-051101~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7849fb559181f8a536c392cd4258db3729176e4c;p=thirdparty%2Fiproute2.git

Fix memcpy overwrite in iproute.c because of bits vs. bytes confusion
---

diff --git a/ChangeLog b/ChangeLog
index 0a2d7f2d0..4d5bd412e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,8 @@
 2005-10-12  Stephen Hemminger  <shemminger@osdl.org>
 
 	* Add more CBQ examples from Fedora Core
-
+	* Fix buffer overrun in iproute because of bits vs. bytes confusion
+	
 2005-10-12  Jamal Hadi Salim <hadi@znyx.com>
 
 	* Fix ip rule flush, need to reopen rtnl
diff --git a/ip/iproute.c b/ip/iproute.c
index c8c32873d..a43c09e6c 100644
--- a/ip/iproute.c
+++ b/ip/iproute.c
@@ -216,13 +216,13 @@ int print_route(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
 		memset(&via, 0, sizeof(via));
 		via.family = r->rtm_family;
 		if (tb[RTA_GATEWAY])
-			memcpy(&via.data, RTA_DATA(tb[RTA_GATEWAY]), host_len);
+			memcpy(&via.data, RTA_DATA(tb[RTA_GATEWAY]), host_len/8);
 	}
 	if (filter.rprefsrc.bitlen>0) {
 		memset(&prefsrc, 0, sizeof(prefsrc));
 		prefsrc.family = r->rtm_family;
 		if (tb[RTA_PREFSRC])
-			memcpy(&prefsrc.data, RTA_DATA(tb[RTA_PREFSRC]), host_len);
+			memcpy(&prefsrc.data, RTA_DATA(tb[RTA_PREFSRC]), host_len/8);
 	}
 
 	if (filter.rdst.family && inet_addr_match(&dst, &filter.rdst, filter.rdst.bitlen))