Make sure that *really* no more than sizeof(ifr.ifr_name) chars are strcpy-ed to ifr.ifr_name and that the string is *always* NUL terminated. New code shouldn't use strcpy(), too. CID 719692
diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index 7176674..d8c81fe 100644
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -1674,7 +1674,8 @@
if (len == 0) {
ifr.ifr_ifindex = 0;
} else if (len < sizeof(ifr.ifr_name)) {
- strcpy(ifr.ifr_name, PyBytes_AS_STRING(interfaceName));
+ strncpy(ifr.ifr_name, PyBytes_AS_STRING(interfaceName), sizeof(ifr.ifr_name));
+ ifr.ifr_name[(sizeof(ifr.ifr_name))-1] = '\0';
if (ioctl(s->sock_fd, SIOCGIFINDEX, &ifr) < 0) {
s->errorhandler();
Py_DECREF(interfaceName);