Skip to content

Commit d134c6c

Browse files
committed
Fix buffer overflow in get_module()
get_module() includes this scanf call: if (sscanf(buf, "%*d\t%*s\t%100s\t%*d\t%100s\n", driver, dev) > 0) { i.e. "%100s" for each of driver and dev. i.e. a maximum field width of 100 for each. However, this field width does not include the NUL terminator. Increase the size of driver and dev from 100 to 101 to allow for the NUL byte. This appears to have been present in the initial commit of the code (8d6ad99) Found by Braňo Náter using the "cppcheck" static analyzer.
1 parent 7c4d887 commit d134c6c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

python-ethtool/ethtool.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -500,7 +500,7 @@ static PyObject *get_module(PyObject *self __unused, PyObject *args)
500500
int eno = errno;
501501
FILE *file;
502502
int found = 0;
503-
char driver[100], dev[100];
503+
char driver[101], dev[101];
504504
close(fd);
505505

506506
/* Before bailing, maybe it is a PCMCIA/PC Card? */

0 commit comments

Comments
 (0)