diff options
| author | Andrew Vagin <avagin@virtuozzo.com> | 2015-11-23 17:23:20 +0300 |
|---|---|---|
| committer | Thomas Haller <thaller@redhat.com> | 2015-11-24 13:44:48 +0100 |
| commit | 7bbd09d9410f5fc0d22f00db26306234a50217a2 (patch) | |
| tree | 351bc1474e3e8e198ba1bd6da91f5d0989360c43 /lib/nl.c | |
| parent | ef32af0f6afd2a0e503d5c535c5e105d76d64629 (diff) | |
| download | libnl-7bbd09d9410f5fc0d22f00db26306234a50217a2.tar.gz | |
libnl: don't use out-of-scope buffer in nl_send_iovec()
The control message buffer is desclared in the if body
and then this buffer is used outside.
http://lists.infradead.org/pipermail/libnl/2015-November/002013.html
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Diffstat (limited to 'lib/nl.c')
| -rw-r--r-- | lib/nl.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -384,6 +384,7 @@ int nl_send_iovec(struct nl_sock *sk, struct nl_msg *msg, struct iovec *iov, uns .msg_iov = iov, .msg_iovlen = iovlen, }; + char buf[CMSG_SPACE(sizeof(struct ucred))]; /* Overwrite destination if specified in the message itself, defaults * to the peer address of the socket. @@ -395,7 +396,6 @@ int nl_send_iovec(struct nl_sock *sk, struct nl_msg *msg, struct iovec *iov, uns /* Add credentials if present. */ creds = nlmsg_get_creds(msg); if (creds != NULL) { - char buf[CMSG_SPACE(sizeof(struct ucred))]; struct cmsghdr *cmsg; hdr.msg_control = buf; |