Network interface names must fit in a buffer of IFNAMSIZ bytes, including the terminating \0. IFNAMSIZ is 16 on Linux, so interface names can be up to (and including) 15 characters long. We validate this for the -I option, but we have an off by one error. We pass (IFNAMSIZ - 1) as the buffer size to snprintf(), but that buffer size already includes the terminating \0, so this actually truncates the value to 14 characters. The return value returned from snprintf() however, is the number of characters that would have been printed *excluding* the terminating \0, so by comparing it >= IFNAMSIZ - 1 we are giving an error on names >= 15 characters rather than strictly > 15 characters. Bugzila: https://bugs.passt.top/show_bug.cgi?id=61 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/conf.c b/conf.c index 68487a41..19064368 100644 --- a/conf.c +++ b/conf.c @@ -1439,9 +1439,9 @@ void conf(struct ctx *c, int argc, char **argv) if (*c->pasta_ifn) die("Multiple --ns-ifname options given"); - ret = snprintf(c->pasta_ifn, IFNAMSIZ - 1, "%s", + ret = snprintf(c->pasta_ifn, IFNAMSIZ, "%s", optarg); - if (ret <= 0 || ret >= IFNAMSIZ - 1) + if (ret <= 0 || ret >= IFNAMSIZ) die("Invalid interface name: %s", optarg); break; -- 2.41.0