Fix stack OOB Write Vulnerability in vpn_service_init

An Out of Bounds Write vulnerability was discovered and fixed
in the vpn_service_init function of net-config,
which could be used to access the stack array without validation
by using a user-provided index,
thereby setting a value(0x00) in an out-of-bounds location.

Change-Id: I6140d21a7601efe4dad96b63a35385399993fd49
Signed-off-by: Jaehyun Kim <jeik01.kim@samsung.com>

diff --git a/src/vpnsvc-internal.c b/src/vpnsvc-internal.c
index 0c71d4581c36a1b9820454c5a0a593caa84c9088..57ffeaa0ae5edaf47290cbb31176043e307660c1 100755 (executable)
--- a/src/vpnsvc-internal.c
+++ b/src/vpnsvc-internal.c
@@ -770,6 +770,12 @@ int vpn_service_init(const char* iface_name, size_t iface_name_len, int fd, vpns
 
        ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 
+       if (iface_name_len >= IFNAMSIZ) {
+               ERR("iface_name_len is too long: %zd", iface_name_len);
+               close(fd);
+               return VPNSVC_ERROR_INVALID_PARAMETER;
+       }
+
        if (*iface_name)
                strncpy(ifr.ifr_name, iface_name, iface_name_len);
        ifr.ifr_name[iface_name_len] = '\0';