#1107470 /usr/bin/ifdata: ifdata -si, -sop et all, stack smashing detected, terminated

Package:
moreutils
Source:
moreutils
Description:
additional Unix utilities
Submitter:
Witold Baryluk
Date:
2026-04-15 20:11:02 UTC
Severity:
normal
#1107470#5
Date:
2025-06-07 22:44:40 UTC
From:
To:
All statistics related commands from ifdata has some bug resulting in
program termination.

$ ifdata -si enp65s0f0np0
*** stack smashing detected ***: terminated
Aborted (core dumped)
$ ifdata -sop enp65s0f0np0
*** stack smashing detected ***: terminated
Aborted (core dumped)



iproute2:

$ ip -s l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    RX:  bytes  packets errors dropped  missed   mcast
    4308703779 24336016      0       0       0       0
    TX:  bytes  packets errors dropped carrier collsns
    4308703779 24336016      0       0       0       0
2: enp7s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:d8:61:11:11:12 brd ff:ff:ff:ff:ff:ff
    RX:  bytes packets errors dropped  missed   mcast
             0       0      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
             0       0      0       2       0       0
    altname enx00d8610db52f
3: enp8s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:d8:61:11:11:13 brd ff:ff:ff:ff:ff:ff
    RX:  bytes packets errors dropped  missed   mcast
             0       0      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
             0       0      0       2       0       0
    altname enx00d8610db530
4: enp65s0f0np0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether 64:9d:99:11:11:22 brd ff:ff:ff:ff:ff:ff
    RX:    bytes   packets errors dropped  missed   mcast
    233345799977 186982026      0   16906       0  100445
    TX:    bytes   packets errors dropped carrier collsns
     20761404438  35581611      0       0       0       0
    altname enx649d99ffee34
5: enp65s0f1np1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000
    link/ether 64:9d:99:11:11:11 brd ff:ff:ff:ff:ff:ff
    RX:  bytes packets errors dropped  missed   mcast
             0       0      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
             0       0      0       2       0       0
    altname enx649d99ffee35
6: lxcbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000
    link/ether 10:66:6a:00:00:00 brd ff:ff:ff:ff:ff:ff
    RX:  bytes packets errors dropped  missed   mcast
             0       0      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
             0       0      0    2658       0       0
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default
    link/ether 02:42:bc:11:11:11 brd ff:ff:ff:ff:ff:ff
    RX:  bytes packets errors dropped  missed   mcast
             0       0      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
             0       0      0     294       0       0
$

Many other commands from ifdata work fine.

Regards,
Witold

#1107470#10
Date:
2025-09-16 13:18:46 UTC
From:
To:
Hello,
I tried to track this down, and it originates from a fscanf in get_stats,
which tries to put the interface name into the "char name[10]" variable.

I was able to reproduce it inside a VM by attaching a virtual usb network adapter,
which gets a 15 bytes interface name ((qemu) device_add usb-net,id=usb-net1).

A package built with attached patch no longer shows the stack smashing.

Kind regards,
Bernhard


(rr) bt
#0  0x00007fd71a387f25 in __vfscanf_internal (s=<optimized out>, format=<optimized out>, argptr=argptr@entry=0x7ffde7e7a7d0, mode_flags=mode_flags@entry=2) at ./stdio-common/vfscanf-internal.c:3020
#1  0x00007fd71a3785e9 in __isoc99_fscanf (stream=stream@entry=0x562293989350, format=format@entry=0x562255d75078 " %20[^:]:%llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu") at ./stdio-common/isoc99_fscanf.c:30
#2  0x0000562255d73d78 in get_stats (iface=iface@entry=0x7ffde7e7bdc9 "enx405400123457") at ./ifdata.c:291
#3  0x0000562255d732e5 in main (argc=3, argv=0x7ffde7e7ab68) at ./ifdata.c:576

#1107470#15
Date:
2025-09-22 14:30:10 UTC
From:
To:
Thanks a lot!

According to Linux's kernels netif_set_alias() [1,2], it would make
sense to increase it even to IFALIASZ (currently: 256).

I am planning to forward a patch to upstream within this week; or do
you want to do it yourself?

Kind regards,
Nicolas


[1]: net/core/dev.c (Linux v6.17-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/core/dev.c?h=v6.17-rc6#n1512

[2]: include/uapi/linux/if.h (Linux v6.17-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/if.h?h=v6.17-rc6#n35

#1107470#20
Date:
2025-09-22 20:52:21 UTC
From:
To:
Am 22.09.25 um 16:30 schrieb Nicolas Schier:


Hello Nicolas,
thanks for taking a look.
If kernel allows names that long I guess this tool should
also use this length, yes.
Would be great if you could forward it to upstream,
I am not really sure where to send it.

Kind regards,
Bernhard

#1107470#25
Date:
2025-09-30 18:58:13 UTC
From:
To:
But I have to correct my own reply: IFALIASZ is irrelevant, as ifdata
only parses /proc/net/dev, thus the POSIX default IFNAMSIZ is the
maximum string lenght (including NULL terminator).  I have not yet
found a fscanf() format string that incorporates the compile-time
variable string length that still looks kind of beautiful.

Hard-coding to a concrete integer (like 10 as it is or 20 as you
suggested) is for sure still possible but does not look "right" to me.
I'll try to find a nicer solution...

Kind regards,
Nicolas

#1107470#30
Date:
2026-04-15 19:22:50 UTC
From:
To:
Extend the hard-coded interface name length limit in ifdata to the POSIX
compliant maximum length of (IFNAMSIZ) when reading from /proc/net/dev.

Witold Baryluk and Bernhard Übelacker reported that interface names
longer than 10 characters caused stack smashing of `ifdata`.  Extend the
hard-coded 10 bytes limitation to IFNAMSIZ.

Reported-by: Witold Baryluk <witold.baryluk@gmail.com>
Reported-by: Bernhard Übelacker <bernhardu@mailbox.org>
Closes: https://bugs.debian.org/1107470
Signed-off-by: Nicolas Schier <nicolas@fjasle.eu>
---
 ifdata.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/ifdata.c b/ifdata.c
index 6e0bd0b..feeabac 100644
--- a/ifdata.c
+++ b/ifdata.c
@@ -267,10 +267,13 @@ static void skipline(FILE *fd) {
 	} while (ch != '\n' && ch != EOF);
 }

+#define ___stringify_(x) #x
+#define __stringify(x) ___stringify_(x)
+
 struct if_stat *get_stats(const char *iface) {
 	FILE *fd;
 	struct if_stat *ifstat;
-	char name[10];
+	char name[IFNAMSIZ+1];

 	if (!(ifstat = malloc(sizeof(struct if_stat)))) {
 		perror("malloc");
@@ -289,7 +292,8 @@ struct if_stat *get_stats(const char *iface) {

 	do {
 		int items = fscanf(fd,
-			" %20[^:]:%llu %llu %llu %llu %llu %llu %llu %llu "
+			" %" __stringify(IFNAMSIZ) "[^:]:"
+			"%llu %llu %llu %llu %llu %llu %llu %llu "
 			"%llu %llu %llu %llu %llu %llu %llu %llu",
 			name,
 			&ifstat->in_bytes,    &ifstat->in_packets,