aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorOuden <Ouden.Biz@gmail.com>2020-03-18 09:58:37 (GMT)
committerJouni Malinen <j@w1.fi>2020-03-21 15:12:29 (GMT)
commit7546c489a95a033c78331915fcdfa0e6fd74d563 (patch)
tree7bd0cee4a6d3d71078084e5dffe86d2b7f902b77
parent22547c31480fa24f6685b26e43ce73043e7fbaec (diff)
downloadhostap-7546c489a95a033c78331915fcdfa0e6fd74d563.zip
hostap-7546c489a95a033c78331915fcdfa0e6fd74d563.tar.gz
hostap-7546c489a95a033c78331915fcdfa0e6fd74d563.tar.bz2
nl80211: Fix RTM NEW/DELLINK IFLA_IFNAME copy for maximum ifname length
If the kernel rtm_newlink or rtm_dellink send the maximum length of ifname (IFNAMSIZ), the event handlers in wpa_driver_nl80211_event_rtm_addlink() and wpa_driver_nl80211_event_rtm_dellink() did not copy the IFLA_IFNAME value. Because the RTA_PAYLOAD (IFLA_IFNAME) length already includes the NULL termination, that equals the IFNAMSIZ. Fix the condition when IFNAME reach maximum size. Signed-off-by: Ouden <Ouden.Biz@gmail.com>
-rw-r--r--src/drivers/driver_nl80211.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index efcd69a..c071cc0 100644
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -1047,7 +1047,7 @@ static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
while (RTA_OK(attr, attrlen)) {
switch (attr->rta_type) {
case IFLA_IFNAME:
- if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
+ if (RTA_PAYLOAD(attr) > IFNAMSIZ)
break;
os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
ifname[RTA_PAYLOAD(attr)] = '\0';
@@ -1222,7 +1222,7 @@ static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
while (RTA_OK(attr, attrlen)) {
switch (attr->rta_type) {
case IFLA_IFNAME:
- if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
+ if (RTA_PAYLOAD(attr) > IFNAMSIZ)
break;
os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
ifname[RTA_PAYLOAD(attr)] = '\0';