ead: fix array overrun

[openwrt.git] / package / ead / src / ead.c

diff --git a/package/ead/src/ead.c b/package/ead/src/ead.c
index c4d3dd9f4164f7bf6c149a4096b950e9486e54cb..6a01ea42dd6198603d425d19f01ebd895ea94fd2 100644 (file)
--- a/package/ead/src/ead.c
+++ b/package/ead/src/ead.c
@@ -250,7 +250,7 @@ ead_send_packet_clone(struct ead_packet *pkt)
        len = sizeof(struct ead_packet) - sizeof(struct ether_header) + ntohl(pktbuf->msg.len);
        pktbuf->len[0] = len >> 8;
        pktbuf->len[1] = len & 0xff;
-       memcpy(pktbuf->srcipaddr, pkt->destipaddr, 4);
+       memcpy(pktbuf->srcipaddr, &pkt->msg.ip, 4);
        memcpy(pktbuf->destipaddr, pkt->srcipaddr, 4);
 
        /* ip checksum */
@@ -344,7 +344,7 @@ handle_set_username(struct ead_packet *pkt, int len, int *nstate)
 
        set_state(EAD_TYPE_SET_USERNAME); /* clear old state */
        strncpy(username, user->username, sizeof(username));
-       username[sizeof(username)] = 0;
+       username[sizeof(username) - 1] = 0;
 
        msg = &pktbuf->msg;
        msg->len = 0;
@@ -622,22 +622,21 @@ ead_pcap_reopen(bool first)
 {
        static char errbuf[PCAP_ERRBUF_SIZE] = "";
 
-       if (pcap_fp_rx != pcap_fp)
+       if (pcap_fp_rx && (pcap_fp_rx != pcap_fp))
                pcap_close(pcap_fp_rx);
 
        if (pcap_fp)
                pcap_close(pcap_fp);
 
-       pcap_fp_rx = pcap_fp;
+       pcap_fp_rx = NULL;
        do {
                pcap_fp = pcap_open_live(ifname, PCAP_MRU, 1, PCAP_TIMEOUT, errbuf);
 #ifdef linux
-               if (brname) {
+               if (brname)
                        pcap_fp_rx = pcap_open_live(brname, PCAP_MRU, 1, PCAP_TIMEOUT, errbuf);
-                       if (!pcap_fp_rx)
-                               pcap_fp_rx = pcap_fp;
-               }
 #endif
+               if (!pcap_fp_rx)
+                       pcap_fp_rx = pcap_fp;
                pcap_setfilter(pcap_fp_rx, &pktfilter);
                if (first && !pcap_fp) {
                        DEBUG(1, "WARNING: unable to open interface '%s'\n", ifname);