From c4017cc4a16b1b7d1854498ba64ed27e5a3d0555 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Wed, 28 Jun 2023 15:11:14 +1000 Subject: [PATCH] conf: Fix size checking of -I interface name Network interface names must fit in a buffer of IFNAMSIZ bytes, including the terminating \0. IFNAMSIZ is 16 on Linux, so interface names can be up to (and including) 15 characters long. We validate this for the -I option, but we have an off by one error. We pass (IFNAMSIZ - 1) as the buffer size to snprintf(), but that buffer size already includes the terminating \0, so this actually truncates the value to 14 characters. The return value returned from snprintf() however, is the number of characters that would have been printed *excluding* the terminating \0, so by comparing it >= IFNAMSIZ - 1 we are giving an error on names >= 15 characters rather than strictly > 15 characters. Link: https://bugs.passt.top/show_bug.cgi?id=61 Signed-off-by: David Gibson Signed-off-by: Stefano Brivio --- conf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/conf.c b/conf.c index 68487a4..1906436 100644 --- a/conf.c +++ b/conf.c @@ -1439,9 +1439,9 @@ void conf(struct ctx *c, int argc, char **argv) if (*c->pasta_ifn) die("Multiple --ns-ifname options given"); - ret = snprintf(c->pasta_ifn, IFNAMSIZ - 1, "%s", + ret = snprintf(c->pasta_ifn, IFNAMSIZ, "%s", optarg); - if (ret <= 0 || ret >= IFNAMSIZ - 1) + if (ret <= 0 || ret >= IFNAMSIZ) die("Invalid interface name: %s", optarg); break;