From 6dfb40acd9b0b421b587f26840dfc072211976c2 Mon Sep 17 00:00:00 2001 From: Sebastian Bixl Date: Sun, 15 Oct 2017 22:34:01 +0200 Subject: [PATCH 04/76] route/vlan: fix memory corruption in rtnl_link_vlan_set_egress_map If you set more than four entries for the vlan egress map a memory corruption occurs because the reallocation does not reserve memory for more than four. Fixes: a7469ce758fac3631df6ce72eb3f89150070e7f8 https://github.com/thom311/libnl/pull/155 [thaller@redhat.com: squashed commits and updated commit message] --- lib/route/link/vlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/route/link/vlan.c b/lib/route/link/vlan.c index 118d5a0..477c9af 100644 --- a/lib/route/link/vlan.c +++ b/lib/route/link/vlan.c @@ -589,7 +589,7 @@ int rtnl_link_vlan_set_egress_map(struct rtnl_link *link, uint32_t from, int to) int new_size = vi->vi_egress_size + 32; void *ptr; - ptr = realloc(vi->vi_egress_qos, new_size); + ptr = realloc(vi->vi_egress_qos, new_size * sizeof(struct vlan_map)); if (!ptr) return -NLE_NOMEM; -- 1.8.3.1