generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3497034 - Buffer not null terminated in UpnpGetIfInfo

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 06:43:52 PST

gIF_NAME might be not null terminated.
(cherry picked from commit eeab71082f)
This commit is contained in:
Fabrice Fontaine
2012-03-05 17:43:26 +01:00
committed by Marcelo Roberto Jimenez
parent d1a4925359
commit 4b7aa238e7
2 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@@ -299,6 +299,14 @@ Version 1.8.0
Version 1.6.16 Version 1.6.16
******************************************************************************* *******************************************************************************
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3497034 - Buffer not null terminated in UpnpGetIfInfo
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 06:43:52 PST
gIF_NAME might be not null terminated.
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com> 2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3497033 - Buffer not null terminated in UpnpInit SF Bug Tracker id 3497033 - Buffer not null terminated in UpnpInit

21
upnp/src/api/upnpapi.c
View File

@@ -3192,7 +3192,8 @@ int UpnpGetIfInfo(const char *IfName)
if (strlen(IfName) > sizeof(gIF_NAME)) if (strlen(IfName) > sizeof(gIF_NAME))
return UPNP_E_INVALID_INTERFACE; return UPNP_E_INVALID_INTERFACE;
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} }
adapts_item = adapts; adapts_item = adapts;
@@ -3213,8 +3214,9 @@ int UpnpGetIfInfo(const char *IfName)
wcstombs(gIF_NAME, adapts_item->FriendlyName, wcstombs(gIF_NAME, adapts_item->FriendlyName,
sizeof(gIF_NAME)); sizeof(gIF_NAME));
#else #else
memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, adapts_item->FriendlyName, strncpy(gIF_NAME, adapts_item->FriendlyName,
sizeof(gIF_NAME)); sizeof(gIF_NAME) - 1);
#endif #endif
ifname_found = 1; ifname_found = 1;
} else { } else {
@@ -3305,7 +3307,8 @@ int UpnpGetIfInfo(const char *IfName)
if (strlen(IfName) > sizeof(gIF_NAME)) if (strlen(IfName) > sizeof(gIF_NAME))
return UPNP_E_INVALID_INTERFACE; return UPNP_E_INVALID_INTERFACE;
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} }
/* Get system interface addresses. */ /* Get system interface addresses. */
@@ -3325,7 +3328,8 @@ int UpnpGetIfInfo(const char *IfName)
} }
if (ifname_found == 0) { if (ifname_found == 0) {
/* We have found a valid interface name. Keep it. */ /* We have found a valid interface name. Keep it. */
strncpy(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} else { } else {
if (strncmp(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME)) if (strncmp(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME))
@@ -3392,7 +3396,8 @@ int UpnpGetIfInfo(const char *IfName)
if (strlen(IfName) > sizeof(gIF_NAME)) if (strlen(IfName) > sizeof(gIF_NAME))
return UPNP_E_INVALID_INTERFACE; return UPNP_E_INVALID_INTERFACE;
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} }
/* Create an unbound datagram socket to do the SIOCGIFADDR ioctl on. */ /* Create an unbound datagram socket to do the SIOCGIFADDR ioctl on. */
@@ -3432,7 +3437,8 @@ int UpnpGetIfInfo(const char *IfName)
} }
if (ifname_found == 0) { if (ifname_found == 0) {
/* We have found a valid interface name. Keep it. */ /* We have found a valid interface name. Keep it. */
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} else { } else {
if (strncmp if (strncmp
@@ -3445,7 +3451,8 @@ int UpnpGetIfInfo(const char *IfName)
/* Check address family. */ /* Check address family. */
if (pifReq->ifr_addr.sa_family == AF_INET) { if (pifReq->ifr_addr.sa_family == AF_INET) {
/* Copy interface name, IPv4 address and interface index. */ /* Copy interface name, IPv4 address and interface index. */
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME) - 1);
inet_ntop(AF_INET, inet_ntop(AF_INET,
&((struct sockaddr_in *)&pifReq->ifr_addr)-> &((struct sockaddr_in *)&pifReq->ifr_addr)->
sin_addr, gIF_IPV4, sizeof(gIF_IPV4)); sin_addr, gIF_IPV4, sizeof(gIF_IPV4));