commit f35169ecdb481ca1e176cbb234b5294b2ca901a7
author Christian Franke <chris@opensourcerouting.org> Thu Nov 12 14:09:08 2015 +0100
committer Donald Sharp <sharpd@cumulusnetworks.com> Tue Dec 08 14:12:49 2015 -0500
tree 2e3121c1bce6685dc50a438443b32fec4d9fbd05
parent b461630bed1a0ed33c3a38fc485caf826ff05ce9

isisd: don't corrupt memory for long hostnames

Signed-off-by: Christian Franke <chris@opensourcerouting.org>
Acked-by: Donald Sharp <sharpd@cumulusnetworks.com>

isisd/isis_lsp.c

diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c
index 8f7fc0a..050a9f9 100644
--- a/isisd/isis_lsp.c
+++ b/isisd/isis_lsp.c
@@ -1225,12 +1225,19 @@
   /* Dynamic Hostname */
   if (area->dynhostname)
     {
+      const char *hostname = unix_hostname();
+      size_t hostname_len = strlen(hostname);
+
       lsp->tlv_data.hostname = XMALLOC (MTYPE_ISIS_TLV,
 					sizeof (struct hostname));
 
-      memcpy (lsp->tlv_data.hostname->name, unix_hostname (),
-	      strlen (unix_hostname ()));
-      lsp->tlv_data.hostname->namelen = strlen (unix_hostname ());
+      strncpy((char *)lsp->tlv_data.hostname->name, hostname,
+              sizeof(lsp->tlv_data.hostname->name));
+      if (hostname_len <= MAX_TLV_LEN)
+        lsp->tlv_data.hostname->namelen = hostname_len;
+      else
+        lsp->tlv_data.hostname->namelen = MAX_TLV_LEN;
+
       tlv_add_dynamic_hostname (lsp->tlv_data.hostname, lsp->pdu);
     }
 

isisd/isis_tlv.h

diff --git a/isisd/isis_tlv.h b/isisd/isis_tlv.h
index e092f4d..f5b59a7 100644
--- a/isisd/isis_tlv.h
+++ b/isisd/isis_tlv.h
@@ -112,6 +112,8 @@
 
 #define AUTH_INFO_HDRLEN          3
 
+#define MAX_TLV_LEN 255
+
 #define IS_NEIGHBOURS_LEN (ISIS_SYS_ID_LEN + 5)
 #define LAN_NEIGHBOURS_LEN 6
 #define LSP_ENTRIES_LEN (10 + ISIS_SYS_ID_LEN)	/* FIXME: should be entry */