Bug 1777 - UDHCP server has a bug
Summary: UDHCP server has a bug
Status: RESOLVED FIXED
Alias: None
Product: Busybox
Classification: Unclassified
Component: Networking (show other bugs)
Version: 1.16.x
Hardware: PC Linux
: P5 minor
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-05-14 08:36 UTC by NieJun
Modified: 2010-05-18 21:34 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description NieJun 2010-05-14 08:36:49 UTC
The udhcpd has a bug of getting dhcp client's hostname. For example, My hostname is 'niejun', bug the udhcpd get the hostname is 'nieju'. And I find the '/var/lib/misc/udhcpd.leases' file also has the hostname 'nieju'.

The leater, I see the source of udhcpd. I find in the file "networking/udhcp/leases.c", at line 69,
    p = safe_strncpy(oldest->hostname, hostname, hostname_len);

The function of 'safe_strncpy' has a bug. 

char* FAST_FUNC safe_strncpy(char *dst, const char *src, size_t size)
{
	if (!size) return dst;
	dst[--size] = '\0';
	return strncpy(dst, src, size);
}

Such as:
char* FAST_FUNC safe_strncpy(char *dst, const char *src, size_t size)
{
	if (!size) return dst;
	dst[size-1] = '\0';
	return strncpy(dst, src, size);
}
Comment 1 Denys Vlasenko 2010-05-15 18:49:37 UTC
> The udhcpd has a bug of getting dhcp client's hostname. For example, My
> hostname is 'niejun', bug the udhcpd get the hostname is 'nieju'. And I find
> the '/var/lib/misc/udhcpd.leases' file also has the hostname 'nieju'.
> 
> The leater, I see the source of udhcpd. I find in the file
> "networking/udhcp/leases.c", at line 69,
>     p = safe_strncpy(oldest->hostname, hostname, hostname_len);

Yes, the bug is here.

> The function of 'safe_strncpy' has a bug. 

No. It meant to ensure the result is NUL-terminated.

> Such as:
> char* FAST_FUNC safe_strncpy(char *dst, const char *src, size_t size)
> {
>     if (!size) return dst;
>     dst[size-1] = '\0';
>     return strncpy(dst, src, size);
> }

This will make it the same as strncpy. What's the point?


Fix is at http://busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-dhcpd.patch