From d4852ff21818a906e603815c5951d0ef382cd851 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Thu, 23 Mar 2006 22:54:18 -0800 Subject: [PATCH] NET: Ensure device name passed to SO_BINDTODEVICE is NULL terminated. The user can pass us arbitrary garbage so we should ensure the string they give us is null terminated before we pass it on to dev_get_by_index() et al. Found by Solar Designer. Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman --- net/core/sock.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'net') diff --git a/net/core/sock.c b/net/core/sock.c index 6e00811d44bc..5621198f18ec 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -404,8 +404,9 @@ set_rcvbuf: if (!valbool) { sk->sk_bound_dev_if = 0; } else { - if (optlen > IFNAMSIZ) - optlen = IFNAMSIZ; + if (optlen > IFNAMSIZ - 1) + optlen = IFNAMSIZ - 1; + memset(devname, 0, sizeof(devname)); if (copy_from_user(devname, optval, optlen)) { ret = -EFAULT; break; -- cgit v1.2.3