diff options
| author | David S. Miller <davem@davemloft.net> | 2006-03-23 22:47:40 -0800 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-03-24 15:44:59 -0800 |
| commit | f67ed26f2b3e92c0450deae3ffc3fff21c878a75 (patch) | |
| tree | c4dcdb47cfb5f3ba498698cd13421d204047b219 /net | |
| parent | a1a8feed1743ec8d2af1dafa7c5321679f0a3e4f (diff) | |
| download | lwn-f67ed26f2b3e92c0450deae3ffc3fff21c878a75.tar.gz lwn-f67ed26f2b3e92c0450deae3ffc3fff21c878a75.zip | |
[NET]: Ensure device name passed to SO_BINDTODEVICE is NULL terminated.
Found by Solar Designer.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/sock.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/core/sock.c b/net/core/sock.c index 1a7e6eac90b0..e110b9004147 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -404,8 +404,9 @@ set_rcvbuf: if (!valbool) { sk->sk_bound_dev_if = 0; } else { - if (optlen > IFNAMSIZ) - optlen = IFNAMSIZ; + if (optlen > IFNAMSIZ - 1) + optlen = IFNAMSIZ - 1; + memset(devname, 0, sizeof(devname)); if (copy_from_user(devname, optval, optlen)) { ret = -EFAULT; break; |