search

freifunk-gluon / l3roamd

BSD 2-Clause "Simplified" License
12 stars 6 forks source link

overread in intercom_info, intercom.c #42

Closed pentallelogram closed 6 years ago

pentallelogram commented 6 years ago

18 bytes are allocated on the stack but not initialized. Let's assume they are non null from the previous stack frame. mac_add_n2a() will initialize that str_mac field but not terminate it. Then when treated as a string in the log_debug(), stack data will be over read into the logs.

christf commented 6 years ago

Thank you for noticing. I was not aware that the terminating property of sprintf is platform-specific as I am working on linux and targeting linux. I guess adding mac_addr[17] = '\0'; to mac_addn2a won't hurt and is a little more defensive.

christf commented 6 years ago

fixed in https://github.com/freifunk-gluon/l3roamd/commit/d14a29c146d03051f60ac6ce380a509cdf97e2a1