From: Phil Sutter <phil@nwl.cc>
Date: Fri, 13 Nov 2015 17:09:04 +0000 (+0100)
Subject: iptunnel: sanitize copying tunnel name
X-Git-Tag: v4.4.0~53
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f53ecee818280961d86c4ffb07c367144b91490d;p=thirdparty%2Fiproute2.git

iptunnel: sanitize copying tunnel name

Since p->name is only IFNAMSIZ bytes, do not copy more than IFNAMSIZ - 1
bytes into it so there remains at least a single null byte in the end.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---

diff --git a/ip/iptunnel.c b/ip/iptunnel.c
index 3b46a1593..b377a5b48 100644
--- a/ip/iptunnel.c
+++ b/ip/iptunnel.c
@@ -175,7 +175,7 @@ static int parse_args(int argc, char **argv, int cmd, struct ip_tunnel_parm *p)
 				usage();
 			if (p->name[0])
 				duparg2("name", *argv);
-			strncpy(p->name, *argv, IFNAMSIZ);
+			strncpy(p->name, *argv, IFNAMSIZ - 1);
 			if (cmd == SIOCCHGTUNNEL && count == 0) {
 				struct ip_tunnel_parm old_p;
 				memset(&old_p, 0, sizeof(old_p));