libmemif: fix segfault and buffer overflow in examples

- Fix buffer overflow caused by strncpy(dst, src, strlen(src)),
use sized buffer to ensure overflow safe.

- Fix test_app getopt usage

 When use example/icmp_responder in slave mode
- Fix segfault when buffer size is not specified
- Fix wrong packet send out.

Type: fix
Signed-off-by: Tianyu Li <[email protected]>
Change-Id: I5ed47fd8e630420d7ae0203a2605d2b9abd33d2a

diff --git a/extras/libmemif/examples/common/packet_handler.c b/extras/libmemif/examples/common/packet_handler.c
index 9d3e4d7..1e97e46 100644 (file)
--- a/extras/libmemif/examples/common/packet_handler.c
+++ b/extras/libmemif/examples/common/packet_handler.c
@@ -48,7 +48,7 @@ icmp_packet_handler (memif_connection_t *c)
       for (i = 0; i < c->tx_buf_num; i++)
        {
          uint32_t len;
-         void *packet = c->rx_bufs[i].data;
+         void *packet = c->tx_bufs[i].data;
 
          memcpy (c->tx_bufs[i].data, c->rx_bufs[i].data, c->rx_bufs[i].len);
          c->tx_bufs[i].flags = c->rx_bufs[i].flags;

diff --git a/extras/libmemif/examples/icmp_responder/main.c b/extras/libmemif/examples/icmp_responder/main.c
index f89f579..d70ecb5 100644 (file)
--- a/extras/libmemif/examples/icmp_responder/main.c
+++ b/extras/libmemif/examples/icmp_responder/main.c
@@ -126,7 +126,7 @@ main (int argc, char *argv[])
   char socket_path[108];
   int id = IF_ID;
 
-  strncpy (socket_path, SOCKET_PATH, strlen (SOCKET_PATH));
+  strncpy (socket_path, SOCKET_PATH, sizeof (SOCKET_PATH));
 
   /* prepare the private data */
   memset (&intf, 0, sizeof (intf));
@@ -219,6 +219,8 @@ main (int argc, char *argv[])
    */
   if (intf.buffer_size)
     memif_conn_args.buffer_size = intf.buffer_size;
+  else
+    intf.buffer_size = 2048;
 
   memif_conn_args.socket = memif_socket;
   memif_conn_args.interface_id = id;

diff --git a/extras/libmemif/examples/test_app/main.c b/extras/libmemif/examples/test_app/main.c
index 763ec6c..54c5392 100644 (file)
--- a/extras/libmemif/examples/test_app/main.c
+++ b/extras/libmemif/examples/test_app/main.c
@@ -201,13 +201,13 @@ main (int argc, char *argv[])
   int id0 = IF_ID0;
   int id1 = IF_ID1;
 
-  strncpy (socket_path, SOCKET_PATH, strlen (SOCKET_PATH));
+  strncpy (socket_path, SOCKET_PATH, sizeof (SOCKET_PATH));
 
   /* prepare the private data */
   memset (&intf0, 0, sizeof (intf0));
   memset (&intf1, 0, sizeof (intf1));
 
-  while ((opt = getopt (argc, argv, "r:s:i:t:b:h:v")) != -1)
+  while ((opt = getopt (argc, argv, "r:s:i:t:b:hv")) != -1)
     {
       switch (opt)
        {