Subject: ss format bug

From: Mike Saal <[email-masked]>
Date: Wed, 26 Aug 2015 11:59:17 -0400

Hi:

I found a formatting bug in the 4.1.1 ss command. The following line was 
incorrectly output due to passing a negative length to printf() when 
displaying the local address. In this instance hostapd does a "bind to 
device" on cdreth0 and then does a udp "in address any" port 67 bind. 
Please note the whitespace between the '*' and ' %cdreth0:67'

    'udp UNCONN 0 0 ** %cdreth0:67* *:* users:(("hostapd",pid=19241,fd=5))'

Attached is my patch for the bug fix, it might be prudent to add more 
guard code looking for negative length format codes.

Sincerely, Mike
diff -Nuar iproute2-4.1.1.orig/misc/ss.c iproute2-4.1.1/misc/ss.c
--- iproute2-4.1.1.orig/misc/ss.c	2015-07-06 17:57:34.000000000 -0400
+++ iproute2-4.1.1/misc/ss.c	2015-08-20 10:37:17.615100588 -0400
@@ -1023,6 +1023,8 @@
 	if (ifindex) {
 		ifname   = ll_index_to_name(ifindex);
 		est_len -= strlen(ifname) + 1;  /* +1 for percent char */
+		if (est_len < 0)
+			est_len = 0;
 	}
 
 	sock_addr_print_width(est_len, ap, ":", serv_width, resolve_service(port),