Calling strncpy with a maximum size argument of 16 bytes on destination
array "ifr.ifr_ifrn.ifrn_name" of size 16 bytes might leave the
destination string unterminated.
Introduced-by: b9692cb90 ("teamd: generate team device names in case they are not
specified")
Signed-off-by: Jiri Pirko <jiri(a)resnulli.us>
---
include/private/misc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/private/misc.h b/include/private/misc.h
index 5eae7ac..9814b45 100644
--- a/include/private/misc.h
+++ b/include/private/misc.h
@@ -88,7 +88,7 @@ static inline int ifname2ifindex(uint32_t *p_ifindex, char *ifname)
if (sock == -1)
return -errno;
memset(&ifr, 0, sizeof(ifr));
- strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+ strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
ret = ioctl(sock, SIOCGIFINDEX, &ifr);
close(sock);
if (ret == -1) {
--
1.9.3