From cb2eb9997a0292a144968d117f4d831c155ca71d Mon Sep 17 00:00:00 2001 From: Andreas Henriksson Date: Thu, 30 Apr 2009 16:50:50 +0200 Subject: [PATCH] Bug#526329: iproute: Segfault on garbage lladdr On tor, 2009-04-30 at 14:32 +0100, Timothy Baldwin wrote: > Package: iproute > Version: 20090324-1 > Severity: minor > > > $ ip link set eth0 address help > "help" is invalid lladdr. > Segmentation fault > > Desipte the invalid command line arguments it shouldn't crash. > Callers need to check return value from ll_addr_a2n(). Patch below. Signed-off-by: Andreas Henriksson --- ip/iplink.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ip/iplink.c b/ip/iplink.c index 18249ca80..3e3b877ac 100644 --- a/ip/iplink.c +++ b/ip/iplink.c @@ -200,11 +200,15 @@ int iplink_parse(int argc, char **argv, struct iplink_req *req, } else if (matches(*argv, "address") == 0) { NEXT_ARG(); len = ll_addr_a2n(abuf, sizeof(abuf), *argv); + if (len < 0) + return -1; addattr_l(&req->n, sizeof(*req), IFLA_ADDRESS, abuf, len); } else if (matches(*argv, "broadcast") == 0 || strcmp(*argv, "brd") == 0) { NEXT_ARG(); len = ll_addr_a2n(abuf, sizeof(abuf), *argv); + if (len < 0) + return -1; addattr_l(&req->n, sizeof(*req), IFLA_BROADCAST, abuf, len); } else if (matches(*argv, "txqueuelen") == 0 || strcmp(*argv, "qlen") == 0 || -- 2.47.2