intel / openlldp

Other
54 stars 42 forks source link

lldpad: fix using uninitialized value #102

Closed liuhangbin closed 1 month ago

liuhangbin commented 2 months ago

When the length is less than sizeof(cmd.ifname), the cmd.ifname will be printed uninitialized, which could cause information leakage. Fix this by copying the maximum size of ifname before printing it out.

This issue was found through static code analysis.

Fixes: a37b7e0f3b66 ("lldpad: initial git commit") Fixes: 3b559d8d0b52 ("VDP: vdptool first version")

liuhangbin commented 2 months ago

Instead, the printf() should probably be changed to print the source value from the memcpy for debug purposes

Thanks, the patch updated.

apconole commented 1 month ago

Merged - thanks!