commit f35169ecdb481ca1e176cbb234b5294b2ca901a7
author Christian Franke <chris@opensourcerouting.org> Thu Nov 12 14:09:08 2015 +0100
committer Donald Sharp <sharpd@cumulusnetworks.com> Tue Dec 08 14:12:49 2015 -0500
tree 2e3121c1bce6685dc50a438443b32fec4d9fbd05
parent b461630bed1a0ed33c3a38fc485caf826ff05ce9

isisd: don't corrupt memory for long hostnames

Signed-off-by: Christian Franke <chris@opensourcerouting.org>
Acked-by: Donald Sharp <sharpd@cumulusnetworks.com>

isisd/isis_lsp.c

diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c
index 8f7fc0a..050a9f9 100644
--- a/isisd/isis_lsp.c
+++ b/isisd/isis_lsp.c
@@ -1225,12 +1225,19 @@
   /* Dynamic Hostname */
   if (area->dynhostname)
     {
+      const char *hostname = unix_hostname();
+      size_t hostname_len = strlen(hostname);
+
       lsp->tlv_data.hostname = XMALLOC (MTYPE_ISIS_TLV,
 					sizeof (struct hostname));
 
-      memcpy (lsp->tlv_data.hostname->name, unix_hostname (),
-	      strlen (unix_hostname ()));
-      lsp->tlv_data.hostname->namelen = strlen (unix_hostname ());
+      strncpy((char *)lsp->tlv_data.hostname->name, hostname,
+              sizeof(lsp->tlv_data.hostname->name));
+      if (hostname_len <= MAX_TLV_LEN)
+        lsp->tlv_data.hostname->namelen = hostname_len;
+      else
+        lsp->tlv_data.hostname->namelen = MAX_TLV_LEN;
+
       tlv_add_dynamic_hostname (lsp->tlv_data.hostname, lsp->pdu);
     }