Skip to content

elbert weutil: bound fscanf field width when reading local MAC - #282

Open
rootkiller6788 wants to merge 1 commit into
facebook:heliumfrom
rootkiller6788:fix-elbert-weutil-fscanf-bounds
Open

elbert weutil: bound fscanf field width when reading local MAC#282
rootkiller6788 wants to merge 1 commit into
facebook:heliumfrom
rootkiller6788:fix-elbert-weutil-fscanf-bounds

Conversation

@rootkiller6788

Copy link
Copy Markdown

Problem

read_local_mac() in elbert_weutil.c reads the management MAC address with:

fscanf(fp, "%s", buffer);

%s has no field-width limit, so a longer-than-expected token in /sys/class/net/eth0/address would overflow buffer. The only caller passes char local_mac[20], so the buffer holds at most 19 characters plus the NUL terminator.

Fix

Bound the field width to match the buffer:

fscanf(fp, "%19s", buffer);

A real MAC address (17 chars, e.g. 00:11:22:33:44:55) still fits, but the read can no longer overflow the buffer if the sysfs node ever returns a longer token.

Fixes #126.

@meta-cla meta-cla Bot added the CLA Signed label Aug 20, 2026
@meta-codesync

meta-codesync Bot commented Aug 20, 2026

Copy link
Copy Markdown

This pull request has been imported. If you are a Meta employee, you can view this in D116743117. (Because this pull request was imported automatically, there will not be any future comments.)

@rootkiller6788
rootkiller6788 marked this pull request as ready for review August 23, 2026 05:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

no limitation for "%s" while calling fscanf()

1 participant