Commit a3e8ee68 authored by roel kluin's avatar roel kluin Committed by David S. Miller
Browse files

ipv4: ARP neigh procfs buffer overflow 



If arp_format_neigh_entry() can be called with n->dev->addr_len == 0, then a
write to hbuffer[-1] occurs.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3d54015b

net/ipv4/arp.c

+3 −1
Original line number Diff line number Diff line
@@ -1304,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq, 
		hbuffer[k++] = hex_asc_lo(n->ha[j]);

		hbuffer[k++] = ':';

	}

	hbuffer[--k] = 0;

	if (k != 0)

		--k;

	hbuffer[k] = 0;

#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)

	}

#endif