Fix potential buffer overflows (even if ancontrol is not setuid).
Submitted by: Aaron Campbell <aaron@cs.dal.ca> from OpenBSD
This commit is contained in:
parent
97e4e97bd1
commit
4dd80e768f
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=61815
@ -1,4 +1,4 @@
|
||||
/*
|
||||
/* $OpenBSD: ancontrol.c,v 1.4 2000/06/18 22:27:41 aaron Exp $ */
|
||||
* Copyright 1997, 1998, 1999
|
||||
* Bill Paul <wpaul@ee.columbia.edu>. All rights reserved.
|
||||
*
|
||||
@ -127,7 +127,7 @@ static void an_getval(iface, areq)
|
||||
|
||||
bzero((char *)&ifr, sizeof(ifr));
|
||||
|
||||
strcpy(ifr.ifr_name, iface);
|
||||
strlcpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name));
|
||||
ifr.ifr_data = (caddr_t)areq;
|
||||
|
||||
s = socket(AF_INET, SOCK_DGRAM, 0);
|
||||
@ -152,7 +152,7 @@ static void an_setval(iface, areq)
|
||||
|
||||
bzero((char *)&ifr, sizeof(ifr));
|
||||
|
||||
strcpy(ifr.ifr_name, iface);
|
||||
strlcpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name));
|
||||
ifr.ifr_data = (caddr_t)areq;
|
||||
|
||||
s = socket(AF_INET, SOCK_DGRAM, 0);
|
||||
@ -1035,24 +1035,21 @@ static void an_setssid(iface, act, arg)
|
||||
an_getval(iface, &areq);
|
||||
ssid = (struct an_ltv_ssidlist *)&areq;
|
||||
|
||||
switch(act) {
|
||||
switch (act) {
|
||||
case ACT_SET_SSID1:
|
||||
bzero(ssid->an_ssid1, sizeof(ssid->an_ssid1));
|
||||
bcopy((char *)arg, (char *)&ssid->an_ssid1,
|
||||
strlen((char *)arg));
|
||||
ssid->an_ssid1_len = strlen((char *)arg);
|
||||
strlcpy(ssid->an_ssid1, (char *)arg, sizeof(ssid->an_ssid1));
|
||||
ssid->an_ssid1_len = strlen(ssid->an_ssid1);
|
||||
break;
|
||||
case ACT_SET_SSID2:
|
||||
bzero(ssid->an_ssid2, sizeof(ssid->an_ssid2));
|
||||
bcopy((char *)arg, (char *)&ssid->an_ssid2,
|
||||
strlen((char *)arg));
|
||||
ssid->an_ssid2_len = strlen((char *)arg);
|
||||
strlcpy(ssid->an_ssid2, (char *)arg, sizeof(ssid->an_ssid2));
|
||||
ssid->an_ssid2_len = strlen(ssid->an_ssid2);
|
||||
break;
|
||||
case ACT_SET_SSID3:
|
||||
bzero(ssid->an_ssid3, sizeof(ssid->an_ssid3));
|
||||
bcopy((char *)arg, (char *)&ssid->an_ssid3,
|
||||
strlen((char *)arg));
|
||||
ssid->an_ssid3_len = strlen((char *)arg);
|
||||
strlcpy(ssid->an_ssid3, (char *)arg, sizeof(ssid->an_ssid3));
|
||||
ssid->an_ssid3_len = strlen(ssid->an_ssid3);
|
||||
break;
|
||||
default:
|
||||
errx(1, "unknown action");
|
||||
|
Loading…
Reference in New Issue
Block a user