38 lines
1.2 KiB
Diff
38 lines
1.2 KiB
Diff
From be31c2648487596f23096278dacd86bf88305a14 Mon Sep 17 00:00:00 2001
|
|
From: "[200~jiangheng" <jiangheng12@huawei.com>
|
|
Date: Wed, 17 Nov 2021 13:41:10 -0800
|
|
Subject: [PATCH] lnstat: fix buffer overflow in header output
|
|
|
|
Running lnstat will cause core dump from reading past end of array.
|
|
|
|
Segmentation fault (core dumped)
|
|
|
|
The maximum value of th.num_lines is HDR_LINES(10), h should not be equal to th.num_lines, array th.hdr may be out of bounds.
|
|
|
|
Signed-off-by jiangheng <jiangheng12@huawei.com>
|
|
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
|
|
Conflict: NA
|
|
Reference: https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit?id=be31c264848
|
|
---
|
|
misc/lnstat.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/misc/lnstat.c b/misc/lnstat.c
|
|
index 89cb0e7e..98904d45 100644
|
|
--- a/misc/lnstat.c
|
|
+++ b/misc/lnstat.c
|
|
@@ -210,8 +210,9 @@ static struct table_hdr *build_hdr_string(struct lnstat_file *lnstat_files,
|
|
}
|
|
ofs += width+1;
|
|
}
|
|
+
|
|
/* fill in spaces */
|
|
- for (h = 1; h <= th.num_lines; h++) {
|
|
+ for (h = 1; h < th.num_lines; h++) {
|
|
for (i = 0; i < ofs; i++) {
|
|
if (th.hdr[h][i] == '\0')
|
|
th.hdr[h][i] = ' ';
|
|
--
|
|
2.23.0
|
|
|