From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 21 Dec 2022 16:37:46 +0000 (+0100)
Subject: owner: Fix potential array out of bounds access
X-Git-Tag: v1.0.6~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9967911e3dabb32901617e81e56602af3b37287f;p=thirdparty%2Fnftables.git

owner: Fix potential array out of bounds access

If the link target length exceeds 'sizeof(tmp)' bytes, readlink() will
return 'sizeof(tmp)'. Using this value as index is illegal.

Original update from Phil, for the conntrack-tools tree, which also has
a copy of this function.

Fixes: 6d085b22a8b5 ("table: support for the table owner flag")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/src/owner.c b/src/owner.c
index 2d98a2e9..20bed38b 100644
--- a/src/owner.c
+++ b/src/owner.c
@@ -66,7 +66,7 @@ static char *portid2name(pid_t pid, uint32_t portid, unsigned long inode)
 			continue;
 
 		rl = readlink(procname, tmp, sizeof(tmp));
-		if (rl <= 0 || rl > (ssize_t)sizeof(tmp))
+		if (rl <= 0 || rl >= (ssize_t)sizeof(tmp))
 			continue;
 
 		tmp[rl] = 0;