[PATCH 08/28] batctl: return only initialized icmp destination unreached bytes

When icmp_interface_write() fails with an unreachable destination, it
prepares a reply packet using original packet but changes the message type
to BATADV_DESTINATION_UNREACHABLE. But when icmp_interface_read() tries to
retrieve this data, the requested packet len could be higher than the
length of the original packet. In this case, the returned packet length
must be truncated to the number of bytes of the original one.

Fixes: 4bd751eed4dc ("batctl: Implement non-routing batadv_icmp in userspace")
Signed-off-by: Sven Eckelmann <[email protected]>
---
 icmp_helper.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/icmp_helper.c b/icmp_helper.c
index 8b4fad7..64be9b2 100644
--- a/icmp_helper.c
+++ b/icmp_helper.c
@@ -471,6 +471,12 @@ ssize_t icmp_interface_read(struct batadv_icmp_header *icmp_packet, size_t len,
 		packet_len = len;
 
 	if (direct_reply_len > 0) {
+		/* never deliver more than was actually stored by the
+		 * dst_unreachable path, nor more than the caller's buffer holds
+		 */
+		if (packet_len > direct_reply_len)
+			packet_len = direct_reply_len;
+
 		memcpy(icmp_packet, icmp_buffer, packet_len);
 		direct_reply_len = 0;
 		return (ssize_t)packet_len;

-- 
2.47.3