[IPVS]: Fix for overflows

[net-next-2.6.git] / net / ipv4 / ipvs / ip_vs_ctl.c

diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 218d9701036e40edbaef431ef4690c01f5b18c2c..12a82e91d22ac4d31cfd62143d1b9aa7e1cdbab2 100644 (file)
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -2059,7 +2059,7 @@ ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
        dst->addr = src->addr;
        dst->port = src->port;
        dst->fwmark = src->fwmark;
-       strcpy(dst->sched_name, src->scheduler->name);
+       strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
        dst->flags = src->flags;
        dst->timeout = src->timeout / HZ;
        dst->netmask = src->netmask;
@@ -2080,6 +2080,7 @@ __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
                list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
                        if (count >= get->num_services)
                                goto out;
+                       memset(&entry, 0, sizeof(entry));
                        ip_vs_copy_service(&entry, svc);
                        if (copy_to_user(&uptr->entrytable[count],
                                         &entry, sizeof(entry))) {
@@ -2094,6 +2095,7 @@ __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
                list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
                        if (count >= get->num_services)
                                goto out;
+                       memset(&entry, 0, sizeof(entry));
                        ip_vs_copy_service(&entry, svc);
                        if (copy_to_user(&uptr->entrytable[count],
                                         &entry, sizeof(entry))) {
@@ -2304,12 +2306,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
                memset(&d, 0, sizeof(d));
                if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
                        d[0].state = IP_VS_STATE_MASTER;
-                       strcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn);
+                       strlcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn, sizeof(d[0].mcast_ifn));
                        d[0].syncid = ip_vs_master_syncid;
                }
                if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
                        d[1].state = IP_VS_STATE_BACKUP;
-                       strcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn);
+                       strlcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn, sizeof(d[1].mcast_ifn));
                        d[1].syncid = ip_vs_backup_syncid;
                }
                if (copy_to_user(user, &d, sizeof(d)) != 0)