xshared: Fix parsing of empty string arg in '-c' option

Calling iptables with '-c ""' resulted in a call to strchr() with an
invalid pointer as 'optarg + 1' points to past the buffer. The most
simple fix is to drop the offset: The global optstring part specifies a
single colon after 'c', so getopt() enforces a valid pointer in optarg.
If it contains a comma at first position, packet counter value parsing
will fail so all cases are covered.

Reported-by: gorbanev.es@gmail.com
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741
Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters")
Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/extensions/iptables.t b/extensions/iptables.t
index b4b6d677abab14af4097225d140c7eb5ec074cf4..5d6d3d15cc5fdf3b245853dae18995d0c7fe9d95 100644 (file)
--- a/extensions/iptables.t
+++ b/extensions/iptables.t
@@ -4,3 +4,8 @@
 -i eth+ -o alongifacename+;=;OK
 ! -i eth0;=;OK
 ! -o eth+;=;OK
+-c "";;FAIL
+-c ,3;;FAIL
+-c 3,;;FAIL
+-c ,;;FAIL
+-c 2,3 -j ACCEPT;-j ACCEPT;OK

diff --git a/iptables/xshared.c b/iptables/xshared.c
index b998dd75aaf0525423312e82232f970ef6d868b6..b1997ea35f8f8055df18bbeed20abec406102f23 100644 (file)
--- a/iptables/xshared.c
+++ b/iptables/xshared.c
@@ -1885,7 +1885,7 @@ void do_parse(int argc, char *argv[],
                        set_option(p->ops, &cs->options, OPT_COUNTERS,
                                   &args->invflags, invert);
                        args->pcnt = optarg;
-                       args->bcnt = strchr(args->pcnt + 1, ',');
+                       args->bcnt = strchr(args->pcnt, ',');
                        if (args->bcnt)
                            args->bcnt++;
                        if (!args->bcnt && xs_has_arg(argc, argv))