From f67ed26f2b3e92c0450deae3ffc3fff21c878a75 Mon Sep 17 00:00:00 2001
From: "David S. Miller" <davem@davemloft.net>
Date: Thu, 23 Mar 2006 22:47:40 -0800
Subject: [PATCH] [NET]: Ensure device name passed to SO_BINDTODEVICE is NULL
terminated.
Found by Solar Designer.
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/core/sock.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index 1a7e6eac90b0..e110b9004147 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -404,8 +404,9 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
if (!valbool) {
sk->sk_bound_dev_if = 0;
} else {
- if (optlen > IFNAMSIZ)
- optlen = IFNAMSIZ;
+ if (optlen > IFNAMSIZ - 1)
+ optlen = IFNAMSIZ - 1;
+ memset(devname, 0, sizeof(devname));
if (copy_from_user(devname, optval, optlen)) {
ret = -EFAULT;
break;
--
GitLab