36 lines
1.1 KiB
Diff
36 lines
1.1 KiB
Diff
|
From 6dfb40acd9b0b421b587f26840dfc072211976c2 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Sebastian Bixl <sebastianbixl@gmx.de>
|
||
|
|
Date: Sun, 15 Oct 2017 22:34:01 +0200
|
||
|
|
Subject: [PATCH 04/76] route/vlan: fix memory corruption in
|
||
|
|
rtnl_link_vlan_set_egress_map
|
||
|
|
|
||
|
|
If you set more than four entries for the vlan egress map a memory
|
||
|
|
corruption occurs because the reallocation does not reserve memory
|
||
|
|
for more than four.
|
||
|
|
|
||
|
|
Fixes: a7469ce758fac3631df6ce72eb3f89150070e7f8
|
||
|
|
|
||
|
|
https://github.com/thom311/libnl/pull/155
|
||
|
|
|
||
|
|
[thaller@redhat.com: squashed commits and updated commit message]
|
||
|
|
---
|
||
|
|
lib/route/link/vlan.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/lib/route/link/vlan.c b/lib/route/link/vlan.c
|
||
|
|
index 118d5a0..477c9af 100644
|
||
|
|
--- a/lib/route/link/vlan.c
|
||
|
|
+++ b/lib/route/link/vlan.c
|
||
|
|
@@ -589,7 +589,7 @@ int rtnl_link_vlan_set_egress_map(struct rtnl_link *link, uint32_t from, int to)
|
||
|
|
int new_size = vi->vi_egress_size + 32;
|
||
|
|
void *ptr;
|
||
|
|
|
||
|
|
- ptr = realloc(vi->vi_egress_qos, new_size);
|
||
|
|
+ ptr = realloc(vi->vi_egress_qos, new_size * sizeof(struct vlan_map));
|
||
|
|
if (!ptr)
|
||
|
|
return -NLE_NOMEM;
|
||
|
|
|
||
|
|
--
|
||
|
|
1.8.3.1
|
||
|
|
|