backfire: package/swconfig: add sanity checks to prevent a segfault (backport of...

SVN-Revision: 24992

diff --git a/package/swconfig/Makefile b/package/swconfig/Makefile
index b0a72ceeb70e3a378707932a5662d9d2658aef45..d7da694b9a7d671924a790aee6f69ce493a0159a 100644 (file)
--- a/package/swconfig/Makefile
+++ b/package/swconfig/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=swconfig
-PKG_RELEASE:=6
+PKG_RELEASE:=7
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/kernel.mk

diff --git a/package/swconfig/src/swlib.c b/package/swconfig/src/swlib.c
index 59456a33d9d5717c38f6abae2a647f6bb3281ef5..c2316d06864ce554568dc107873a0b98f3025875 100644 (file)
--- a/package/swconfig/src/swlib.c
+++ b/package/swconfig/src/swlib.c
@@ -368,11 +368,26 @@ int swlib_set_attr_string(struct switch_dev *dev, struct switch_attr *a, int por
                ptr = (char *)str;
                while(ptr && *ptr)
                {
+                       while(*ptr && isspace(*ptr))
+                               ptr++;
+
+                       if (!*ptr)
+                               break;
+
+                       if (!isdigit(*ptr))
+                               return -1;
+
+                       if (val.len >= dev->ports)
+                               return -1;
+
                        ports[val.len].flags = 0;
                        ports[val.len].id = strtoul(ptr, &ptr, 10);
                        while(*ptr && !isspace(*ptr)) {
                                if (*ptr == 't')
                                        ports[val.len].flags |= SWLIB_PORT_FLAG_TAGGED;
+                               else
+                                       return -1;
+
                                ptr++;
                        }
                        if (*ptr)