From f53ecee818280961d86c4ffb07c367144b91490d Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 13 Nov 2015 18:09:04 +0100 Subject: [PATCH] iptunnel: sanitize copying tunnel name Since p->name is only IFNAMSIZ bytes, do not copy more than IFNAMSIZ - 1 bytes into it so there remains at least a single null byte in the end. Signed-off-by: Phil Sutter --- ip/iptunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ip/iptunnel.c b/ip/iptunnel.c index 3b46a1593..b377a5b48 100644 --- a/ip/iptunnel.c +++ b/ip/iptunnel.c @@ -175,7 +175,7 @@ static int parse_args(int argc, char **argv, int cmd, struct ip_tunnel_parm *p) usage(); if (p->name[0]) duparg2("name", *argv); - strncpy(p->name, *argv, IFNAMSIZ); + strncpy(p->name, *argv, IFNAMSIZ - 1); if (cmd == SIOCCHGTUNNEL && count == 0) { struct ip_tunnel_parm old_p; memset(&old_p, 0, sizeof(old_p)); -- 2.47.2