version() strips the trailing newline from line_ptr before checking whether
read_file() actually succeeded. If the read_file() returned an error, it
could be that line_ptr was allocated buyt not yet initialized. It could
therefore not contain any \0 delimiter - making the strlen read outside the
buffer. The write of the \0 could therefore also be outside the buffer.
Only attempt to access the buffer when a success was indicated.
Fixes: dbc4a8c8e585 ("batctl: version also prints the kernel module version if
available")
Signed-off-by: Sven Eckelmann <[email protected]>
---
main.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/main.c b/main.c
index 79ed4ef..e625291 100644
--- a/main.c
+++ b/main.c
@@ -132,13 +132,14 @@ static void version(void)
printf("batctl %s [batman-adv: ", SOURCE_VERSION);
ret = read_file(module_ver_path, USE_READ_BUFF | SILENCE_ERRORS);
- if ((line_ptr) && (line_ptr[strlen(line_ptr) - 1] == '\n'))
- line_ptr[strlen(line_ptr) - 1] = '\0';
+ if (ret == EXIT_SUCCESS) {
+ if (line_ptr[strlen(line_ptr) - 1] == '\n')
+ line_ptr[strlen(line_ptr) - 1] = '\0';
- if (ret == EXIT_SUCCESS)
printf("%s]\n", line_ptr);
- else
+ } else {
printf("module version unknown]\n");
+ }
free(line_ptr);
exit(EXIT_SUCCESS);
--
2.47.3
