From d66114beceb122b4ab24410dd1178ff475411fef Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Sun, 12 Apr 2015 18:23:23 +0200 Subject: [PATCH] network stack: Copy right amount of data from request buffer. The full size of the entry, including the size of the following addresses, was used when copying the request instead of just the request buffer size. Also clear the request buffer to 0 as not all of it is otherwise initialized. --- src/add-ons/kernel/network/stack/routes.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/add-ons/kernel/network/stack/routes.cpp b/src/add-ons/kernel/network/stack/routes.cpp index 0a704072e8..9b0993445e 100644 --- a/src/add-ons/kernel/network/stack/routes.cpp +++ b/src/add-ons/kernel/network/stack/routes.cpp @@ -323,6 +323,7 @@ list_routes(net_domain_private* domain, void* buffer, size_t size) RecursiveLocker _(domain->lock); RouteList::Iterator iterator = domain->routes.GetIterator(); + const size_t baseSize = IF_NAMESIZE + sizeof(route_entry); size_t spaceLeft = size; sockaddr zeros; @@ -333,7 +334,7 @@ list_routes(net_domain_private* domain, void* buffer, size_t size) while (iterator.HasNext()) { net_route* route = iterator.Next(); - size = IF_NAMESIZE + sizeof(route_entry); + size = baseSize; sockaddr* destination = NULL; sockaddr* mask = NULL; @@ -360,6 +361,8 @@ list_routes(net_domain_private* domain, void* buffer, size_t size) return ENOBUFS; ifreq request; + memset(&request, 0, sizeof(request)); + strlcpy(request.ifr_name, route->interface_address->interface->name, IF_NAMESIZE); request.ifr_route.destination = destination; @@ -369,7 +372,7 @@ list_routes(net_domain_private* domain, void* buffer, size_t size) request.ifr_route.flags = route->flags; // copy data into userland buffer - if (user_memcpy(buffer, &request, size) < B_OK + if (user_memcpy(buffer, &request, baseSize) < B_OK || (route->destination != NULL && user_memcpy(request.ifr_route.destination, route->destination, route->destination->sa_len) < B_OK)