From 0d72ae7adc4995a3f89ffcf3affbee5cc56a0003 Mon Sep 17 00:00:00 2001
From: 0scar <qgt268@alumni.ku.dk>
Date: Tue, 11 Feb 2025 09:27:53 +0100
Subject: Fix overflow

---
 status.c | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

(limited to 'status.c')

diff --git a/status.c b/status.c
index 6bdcbc7..9acdca2 100644
--- a/status.c
+++ b/status.c
@@ -2,19 +2,14 @@
 #include <errno.h>
 #include <ifaddrs.h>
 #include <linux/if.h>
-#include <linux/net.h>
 #include <linux/wireless.h>
 #include <netinet/in.h>
 #include <stdbool.h>
-#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
-/* Required for timercmp */
-#define __USE_MISC
-#include <sys/time.h>
 #include <time.h>
 #include <unistd.h>
 
@@ -56,7 +51,7 @@ struct interface_status {
     char ip6[INET6_ADDRSTRLEN];
   } address;
   char ssid[IW_ESSID_MAX_SIZE + 1];
-  char name[IFNAMSIZ];
+  char name[IFNAMSIZ + 1];
 };
 
 /* Prototypes */
@@ -197,8 +192,9 @@ void
 get_essid(char* if_name, char* dst) {
   /* Get the SSID */
   struct iwreq wreq;
-  size_t l = strlen(if_name);
-  int sock = socket(AF_INET, SOCK_DGRAM, 0);
+  const size_t if_namelen = strlen(if_name) - 1;
+  const size_t l          = if_namelen > IFNAMSIZ ? IFNAMSIZ : if_namelen;
+  int sock                = socket(AF_INET, SOCK_DGRAM, 0);
 
   if (sock == -1) {
     return;
@@ -333,13 +329,19 @@ get_net_link_status(char* buf) {
 
   memset(buf, 0, ELEMENT_STRBUF_SZ);
   for (size_t i = 0; i < c; i++) {
-    // int i = 0; {
     struct interface_status* s = &interfaces[i];
     // Write the status string to the output buffer
-    const size_t namelen = strlen(s->name);
-    strncat(buf + n, s->name, namelen);
+    size_t namelen = strlen(s->name);
+
+    /* test the size */
+    if (namelen + n >= ELEMENT_STRBUF_SZ)
+      return;
+
+    memcpy(buf + n, s->name, namelen);
     n += namelen;
 
+    if (n >= ELEMENT_STRBUF_SZ)
+      return;
     size_t ssid_len = strlen(s->ssid);
     if (ssid_len > 0) {
       buf[n++] = ' ';
-- 
cgit v1.3