Skip to content

Commit

Permalink
ip_tunnel: Fix name string concatenate in __ip_tunnel_create()
Browse files Browse the repository at this point in the history
By passing a limit of 2 bytes to strncat, strncat is limited to writing
fewer bytes than what it's supposed to append to the name here.

Since the bounds are checked on the line above this, just remove the string
bounds checks entirely since they're unneeded.

Signed-off-by: Sultan Alsawaf <sultanxda@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
kerneltoast authored and davem330 committed Jun 7, 2018
1 parent 52acf73 commit 000ade8
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions net/ipv4/ip_tunnel.c
Original file line number Diff line number Diff line change
Expand Up @@ -261,8 +261,8 @@ static struct net_device *__ip_tunnel_create(struct net *net,
} else {
if (strlen(ops->kind) > (IFNAMSIZ - 3))
goto failed;
strlcpy(name, ops->kind, IFNAMSIZ);
strncat(name, "%d", 2);
strcpy(name, ops->kind);
strcat(name, "%d");
}

ASSERT_RTNL();
Expand Down

0 comments on commit 000ade8

Please sign in to comment.