generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3497034 - Buffer not null terminated in UpnpGetIfInfo

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 06:43:52 PST

gIF_NAME might be not null terminated.
(cherry picked from commit eeab71082f112141e5ebb621e38e670f43a6e73b)
This commit is contained in:
Fabrice Fontaine 2012-03-05 17:43:26 +01:00 committed by Marcelo Roberto Jimenez
parent d1a4925359
commit 4b7aa238e7
2 changed files with 22 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -299,6 +299,14 @@ Version 1.8.0
Version 1.6.16
*******************************************************************************
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3497034 - Buffer not null terminated in UpnpGetIfInfo
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 06:43:52 PST
gIF_NAME might be not null terminated.
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3497033 - Buffer not null terminated in UpnpInit

21
upnp/src/api/upnpapi.c
View File

@ -3192,7 +3192,8 @@ int UpnpGetIfInfo(const char *IfName)
if (strlen(IfName) > sizeof(gIF_NAME))
return UPNP_E_INVALID_INTERFACE;
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME));
memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME) - 1);
ifname_found = 1;
}
adapts_item = adapts;
@ -3213,8 +3214,9 @@ int UpnpGetIfInfo(const char *IfName)
wcstombs(gIF_NAME, adapts_item->FriendlyName,
sizeof(gIF_NAME));
#else
memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, adapts_item->FriendlyName,
sizeof(gIF_NAME));
sizeof(gIF_NAME) - 1);
#endif
ifname_found = 1;
} else {
@ -3305,7 +3307,8 @@ int UpnpGetIfInfo(const char *IfName)
if (strlen(IfName) > sizeof(gIF_NAME))
return UPNP_E_INVALID_INTERFACE;
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME));
memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME) - 1);
ifname_found = 1;
}
/* Get system interface addresses. */
@ -3325,7 +3328,8 @@ int UpnpGetIfInfo(const char *IfName)
}
if (ifname_found == 0) {
/* We have found a valid interface name. Keep it. */
strncpy(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME));
memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME) - 1);
ifname_found = 1;
} else {
if (strncmp(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME))
@ -3392,7 +3396,8 @@ int UpnpGetIfInfo(const char *IfName)
if (strlen(IfName) > sizeof(gIF_NAME))
return UPNP_E_INVALID_INTERFACE;
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME));
memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME) - 1);
ifname_found = 1;
}
/* Create an unbound datagram socket to do the SIOCGIFADDR ioctl on. */
@ -3432,7 +3437,8 @@ int UpnpGetIfInfo(const char *IfName)
}
if (ifname_found == 0) {
/* We have found a valid interface name. Keep it. */
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME));
memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME) - 1);
ifname_found = 1;
} else {
if (strncmp
@ -3445,7 +3451,8 @@ int UpnpGetIfInfo(const char *IfName)
/* Check address family. */
if (pifReq->ifr_addr.sa_family == AF_INET) {
/* Copy interface name, IPv4 address and interface index. */
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME));
memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME) - 1);
inet_ntop(AF_INET,
&((struct sockaddr_in *)&pifReq->ifr_addr)->
sin_addr, gIF_IPV4, sizeof(gIF_IPV4));