Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add null terminator to c-string passed to 'libc::open' #372

Merged
merged 1 commit into from
Dec 25, 2020
Merged

add null terminator to c-string passed to 'libc::open' #372

merged 1 commit into from
Dec 25, 2020

Conversation

JOE1994
Copy link
Contributor

@JOE1994 JOE1994 commented Aug 19, 2020

Hello 🦀 , this PR appends a null-terminator(\0) to c-string fed to libc::open.

Function signature of libc::open is as follows.
open(path: *const c_char, oflag: c_int, ...) -> c_int

Buffer-over-read could happen when the libc implementation relies on path terminating with a null byte.

In src/phy/sys/tap_interface.rs, a string fed to libc::open is appended with a null terminator.
This PR is to do the same thing in src/phy/sys/bpf.rs.

let lower = libc::open("/dev/net/tun\0".as_ptr() as *const libc::c_char,

Thank you for reviewing this PR 😺

@Dirbaio
Copy link
Member

Dirbaio commented Dec 25, 2020

This is indeed a nasty bug, thanks for the PR!

@Dirbaio Dirbaio merged commit 9e06a04 into smoltcp-rs:master Dec 25, 2020
@JOE1994 JOE1994 deleted the null_terminator branch December 26, 2020 01:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants