generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3497034 - Buffer not null terminated in UpnpGetIfInfo

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 06:43:52 PST

gIF_NAME might be not null terminated.
This commit is contained in:
Fabrice Fontaine 2012-03-05 17:43:26 +01:00
parent f6e88d5b0a
commit eeab71082f
2 changed files with 22 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -2,6 +2,14 @@
Version 1.6.16 Version 1.6.16
******************************************************************************* *******************************************************************************
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3497034 - Buffer not null terminated in UpnpGetIfInfo
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 06:43:52 PST
gIF_NAME might be not null terminated.
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com> 2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3497033 - Buffer not null terminated in UpnpInit SF Bug Tracker id 3497033 - Buffer not null terminated in UpnpInit

21
upnp/src/api/upnpapi.c
View File

@ -3083,7 +3083,8 @@ int UpnpGetIfInfo(const char *IfName)
if (strlen(IfName) > sizeof(gIF_NAME)) if (strlen(IfName) > sizeof(gIF_NAME))
return UPNP_E_INVALID_INTERFACE; return UPNP_E_INVALID_INTERFACE;
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} }
adapts_item = adapts; adapts_item = adapts;
@ -3104,8 +3105,9 @@ int UpnpGetIfInfo(const char *IfName)
wcstombs(gIF_NAME, adapts_item->FriendlyName, wcstombs(gIF_NAME, adapts_item->FriendlyName,
sizeof(gIF_NAME)); sizeof(gIF_NAME));
#else #else
memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, adapts_item->FriendlyName, strncpy(gIF_NAME, adapts_item->FriendlyName,
sizeof(gIF_NAME)); sizeof(gIF_NAME) - 1);
#endif #endif
ifname_found = 1; ifname_found = 1;
} else { } else {
@ -3196,7 +3198,8 @@ int UpnpGetIfInfo(const char *IfName)
if (strlen(IfName) > sizeof(gIF_NAME)) if (strlen(IfName) > sizeof(gIF_NAME))
return UPNP_E_INVALID_INTERFACE; return UPNP_E_INVALID_INTERFACE;
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} }
/* Get system interface addresses. */ /* Get system interface addresses. */
@ -3216,7 +3219,8 @@ int UpnpGetIfInfo(const char *IfName)
} }
if (ifname_found == 0) { if (ifname_found == 0) {
/* We have found a valid interface name. Keep it. */ /* We have found a valid interface name. Keep it. */
strncpy(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} else { } else {
if (strncmp(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME)) if (strncmp(gIF_NAME, ifa->ifa_name, sizeof(gIF_NAME))
@ -3283,7 +3287,8 @@ int UpnpGetIfInfo(const char *IfName)
if (strlen(IfName) > sizeof(gIF_NAME)) if (strlen(IfName) > sizeof(gIF_NAME))
return UPNP_E_INVALID_INTERFACE; return UPNP_E_INVALID_INTERFACE;
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, IfName, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} }
/* Create an unbound datagram socket to do the SIOCGIFADDR ioctl on. */ /* Create an unbound datagram socket to do the SIOCGIFADDR ioctl on. */
@ -3323,7 +3328,8 @@ int UpnpGetIfInfo(const char *IfName)
} }
if (ifname_found == 0) { if (ifname_found == 0) {
/* We have found a valid interface name. Keep it. */ /* We have found a valid interface name. Keep it. */
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME) - 1);
ifname_found = 1; ifname_found = 1;
} else { } else {
if (strncmp if (strncmp
@ -3336,7 +3342,8 @@ int UpnpGetIfInfo(const char *IfName)
/* Check address family. */ /* Check address family. */
if (pifReq->ifr_addr.sa_family == AF_INET) { if (pifReq->ifr_addr.sa_family == AF_INET) {
/* Copy interface name, IPv4 address and interface index. */ /* Copy interface name, IPv4 address and interface index. */
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME)); memset(gIF_NAME, 0, sizeof(gIF_NAME));
strncpy(gIF_NAME, pifReq->ifr_name, sizeof(gIF_NAME) - 1);
inet_ntop(AF_INET, inet_ntop(AF_INET,
&((struct sockaddr_in *)&pifReq->ifr_addr)-> &((struct sockaddr_in *)&pifReq->ifr_addr)->
sin_addr, gIF_IPV4, sizeof(gIF_IPV4)); sin_addr, gIF_IPV4, sizeof(gIF_IPV4));