IPACM: fix the security issue in ConntrackClient am: d772782af3
am: 7c8ac32ad7
Change-Id: I3a9e5b657e559cbf00466ccde840742c266dbd43
diff --git a/msm8998/ipacm/src/IPACM_ConntrackClient.cpp b/msm8998/ipacm/src/IPACM_ConntrackClient.cpp
index 10154ea..ffb0088 100644
--- a/msm8998/ipacm/src/IPACM_ConntrackClient.cpp
+++ b/msm8998/ipacm/src/IPACM_ConntrackClient.cpp
@@ -173,10 +173,18 @@
uint32_t ipv4_addr;
struct ifreq ifr;
+ if(strlen(IPACM_Iface::ipacmcfg->ipa_virtual_iface_name) >= sizeof(ifr.ifr_name))
+ {
+ IPACMERR("interface name overflows: len %d\n",
+ strlen(IPACM_Iface::ipacmcfg->ipa_virtual_iface_name));
+ close(fd);
+ return -1;
+ }
+
/* retrieve bridge interface ipv4 address */
memset(&ifr, 0, sizeof(struct ifreq));
ifr.ifr_addr.sa_family = AF_INET;
- (void)strncpy(ifr.ifr_name, IPACM_Iface::ipacmcfg->ipa_virtual_iface_name, sizeof(ifr.ifr_name));
+ (void)strlcpy(ifr.ifr_name, IPACM_Iface::ipacmcfg->ipa_virtual_iface_name, sizeof(ifr.ifr_name));
IPACMDBG("bridge interface name (%s)\n", ifr.ifr_name);
ret = ioctl(fd, SIOCGIFADDR, &ifr);