[netifd] interface-ip:fix memory corruption bug when setting resolv.conf path

Junnan XU nan1990_06 at 163.com
Mon Dec 6 19:34:16 PST 2021


From: Junnan XU <nan1990_06 at 163.com>

The value of the resolv_conf variable can be specified by input parameters
when netifd is started.So when the length of the resolv_conf variable value
is less than "/tmp/resolv.conf-%s.d/resolv.conf.auto", the memory
out-of-bounds operation will occur in interface_write_resolv_conf
function.

Signed-off-by: Junnan XU <nan1990_06 at 163.com>
---
  interface-ip.c | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/interface-ip.c b/interface-ip.c
index 7b63ef9..2934575 100644
--- a/interface-ip.c
+++ b/interface-ip.c
@@ -1545,7 +1545,10 @@ __interface_write_dns_entries(FILE *f, const char 
*jail)
  void
  interface_write_resolv_conf(const char *jail)
  {
-	size_t plen = (jail ? strlen(jail) + 1 : 0 ) + strlen(resolv_conf) + 1;
+	size_t resolv_conf_len = strlen(resolv_conf);
+	size_t tmp_resolve_conf_len = 
strlen("/tmp/resolv.conf-.d/resolv.conf.auto");
+	size_t plen = (jail ? strlen(jail) + 1 : 0) + (resolv_conf_len > 
tmp_resolve_conf_len ?
+		resolv_conf_len : tmp_resolve_conf_len) + 1;
  	char *path = alloca(plen);
  	char *dpath = alloca(plen);
  	char *tmppath = alloca(plen + 4);
-- 
2.25.1




More information about the openwrt-devel mailing list