diff options
| author | drkhsh <me@drkhsh.at> | 2026-06-23 21:08:33 +0200 |
|---|---|---|
| committer | drkhsh <me@drkhsh.at> | 2026-06-24 00:12:47 +0200 |
| commit | 0dc0c59dbefbd38a8c59004e941260a26fe4bccf (patch) | |
| tree | e3b50aa5d1d430d7f0c00ed19ae826c133bde66d /components | |
| parent | 60b28d8a78b14ecc43f1c7d177cfa5f8597e2071 (diff) | |
| download | slstatus-0dc0c59dbefbd38a8c59004e941260a26fe4bccf.tar.gz | |
fix wifi buffer overflows on Linux
replace strcpy of interface name into ifr_name (IFNAMSIZ=16) with
bounds-checked snprintf. add one byte to resp buffer so NUL-terminating
the SSID at resp boundary does not write out of bounds.
Diffstat (limited to 'components')
| -rw-r--r-- | components/wifi.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/components/wifi.c b/components/wifi.c index 8b33baa..806a7ad 100644 --- a/components/wifi.c +++ b/components/wifi.c @@ -23,7 +23,7 @@ static int nlsock = -1; static uint32_t seq = 1; - static char resp[4096]; + static char resp[4096 + 1]; static char * findattr(int attr, const char *p, const char *e, size_t *len) @@ -109,7 +109,11 @@ return -1; } if (strcmp(ifr.ifr_name, interface) != 0) { - strcpy(ifr.ifr_name, interface); + if (snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), + "%s", interface) >= (int)sizeof(ifr.ifr_name)) { + warn("interface name too long: '%s'", interface); + return -1; + } } if (ioctl(ifsock, SIOCGIFINDEX, &ifr) != 0) { warn("ioctl 'SIOCGIFINDEX':"); @@ -159,7 +163,7 @@ warn("send 'AF_NETLINK':"); return NULL; } - r = recv(nlsock, resp, sizeof(resp), 0); + r = recv(nlsock, resp, sizeof(resp) - 1, 0); if (r < 0) { warn("recv 'AF_NETLINK':"); return NULL; |