[PATCH 26/28] batctl: bisect_iv: avoid write before buffer whole tokenizing log

[Sven Eckelmann]

When neigh and prev_sender are tokenized, their string length is removed by
2 characters. But strtok_r only guarantees 1 character. A malformed log
would therefore cause a write before the start of the actual data.

Fixes: c3b15dbec883 ("[batctl] bisect - better routing table handling due to 
add/update/delete detection")
Fixes: 8a3d4fed1067 ("[batctl] bisect - fix handling of large bat-host files")
Signed-off-by: Sven Eckelmann <s...@narfation.org>
---
 bisect_iv.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/bisect_iv.c b/bisect_iv.c
index 0e34d37..4420be9 100644
--- a/bisect_iv.c
+++ b/bisect_iv.c
@@ -593,7 +593,8 @@ static int parse_log_file(char *file_path)
                                case 4:
                                        if (rt_flag == RT_FLAG_ADD) {
                                                neigh = tok_ptr;
-                                               neigh[strlen(neigh) - 2] = 0;
+                                               if (strlen(neigh) >= 2)
+                                                       neigh[strlen(neigh) - 
2] = 0;
                                        }
                                        break;
                                case 5:
@@ -601,7 +602,8 @@ static int parse_log_file(char *file_path)
                                        break;
                                case 9:
                                        prev_sender = tok_ptr;
-                                       prev_sender[strlen(prev_sender) - 2] = 
0;
+                                       if (strlen(prev_sender) >= 2)
+                                               prev_sender[strlen(prev_sender) 
- 2] = 0;
                                        break;
                                }
                        }

-- 
2.47.3