Commit a3e8ee68 authored by roel kluin's avatar roel kluin Committed by David S. Miller

ipv4: ARP neigh procfs buffer overflow

If arp_format_neigh_entry() can be called with n->dev->addr_len == 0, then a
write to hbuffer[-1] occurs.
Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3d54015b
...@@ -1304,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq, ...@@ -1304,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq,
hbuffer[k++] = hex_asc_lo(n->ha[j]); hbuffer[k++] = hex_asc_lo(n->ha[j]);
hbuffer[k++] = ':'; hbuffer[k++] = ':';
} }
hbuffer[--k] = 0; if (k != 0)
--k;
hbuffer[k] = 0;
#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE) #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
} }
#endif #endif
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment