Calling strncpy with a maximum size argument of 16 bytes on destination array "ifr.ifr_ifrn.ifrn_name" of size 16 bytes might leave the destination string unterminated.
Introduced-by: b9692cb90 ("teamd: generate team device names in case they are not specified") Signed-off-by: Jiri Pirko jiri@resnulli.us --- include/private/misc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/private/misc.h b/include/private/misc.h index 5eae7ac..9814b45 100644 --- a/include/private/misc.h +++ b/include/private/misc.h @@ -88,7 +88,7 @@ static inline int ifname2ifindex(uint32_t *p_ifindex, char *ifname) if (sock == -1) return -errno; memset(&ifr, 0, sizeof(ifr)); - strncpy(ifr.ifr_name, ifname, IFNAMSIZ); + strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1); ret = ioctl(sock, SIOCGIFINDEX, &ifr); close(sock); if (ret == -1) {