]> git.ipfire.org Git - thirdparty/iptables.git/commitdiff
iptables: Fix crash on malformed iptables-restore
authorOliver Ford <ojford@gmail.com>
Fri, 19 May 2017 12:02:26 +0000 (12:02 +0000)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 29 May 2017 11:42:23 +0000 (13:42 +0200)
Fixes the crash reported in Bugzilla #1131 where a malformed parameter that
specifies the table option during a restore can create an invalid pointer.
It was discovered during fuzz testing that options like '-ftf'
can cause a segfault. A parameter that includes a 't' is not currently
filtered correctly.

Improves the filtering to:
Filter a beginning '-' followed by a character other than '-' and then a 't'
anywhere in the parameter. This filters parameters like '-ftf'.
Filter '--t'.
Filter '--table', stopping when the parameter length is reached. Because the
getopt_long function allows abbreviations, any unique abbreviation of '--table'
will be treated as '--table'. This filters parameters like '--t', '--ta', but not
'--ttl' or '--target'.

Signed-off-by: Oliver Ford <ojford@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables/ip6tables-restore.c
iptables/iptables-restore.c
iptables/iptables-xml.c
iptables/xtables-restore.c

index 1e50bf0db2766d717e46189df46cbdce96498f6c..eaa2bcbc3856e08379bfdb0655bc9a8fc38cf3cf 100644 (file)
@@ -165,8 +165,11 @@ static void add_param_to_argv(char *parsestart)
                        param_buffer[param_len] = '\0';
 
                        /* check if table name specified */
-                       if (!strncmp(param_buffer, "-t", 2)
-                            || !strncmp(param_buffer, "--table", 8)) {
+                       if ((param_buffer[0] == '-' &&
+                            param_buffer[1] != '-' &&
+                            strchr(param_buffer, 't')) ||
+                           (!strncmp(param_buffer, "--t", 3) &&
+                            !strncmp(param_buffer, "--table", strlen(param_buffer)))) {
                                xtables_error(PARAMETER_PROBLEM,
                                "The -t option (seen in line %u) cannot be "
                                "used in ip6tables-restore.\n", line);
index d79fe328cc0c1d41b8d92250a04adbed8292ca41..9dbfc572a7cec6332312b1fe06d58305238ae8fe 100644 (file)
@@ -162,8 +162,11 @@ static void add_param_to_argv(char *parsestart)
                        param_buffer[param_len] = '\0';
 
                        /* check if table name specified */
-                       if (!strncmp(param_buffer, "-t", 2)
-                           || !strncmp(param_buffer, "--table", 8)) {
+                       if ((param_buffer[0] == '-' &&
+                            param_buffer[1] != '-' &&
+                            strchr(param_buffer, 't')) ||
+                           (!strncmp(param_buffer, "--t", 3) &&
+                            !strncmp(param_buffer, "--table", strlen(param_buffer)))) {
                                xtables_error(PARAMETER_PROBLEM,
                                "The -t option (seen in line %u) cannot be "
                                "used in iptables-restore.\n", line);
index 2e093b5456fc142602f71c254b7ef9979b8534aa..56b8372b7adcb3f51d7bf0ba1805aeea2df6a559 100644 (file)
@@ -819,9 +819,11 @@ iptables_xml_main(int argc, char *argv[])
                                        *(param_buffer + param_len) = '\0';
 
                                        /* check if table name specified */
-                                       if (!strncmp(param_buffer, "-t", 3)
-                                           || !strncmp(param_buffer,
-                                                       "--table", 8)) {
+                                       if ((param_buffer[0] == '-' &&
+                                            param_buffer[1] != '-' &&
+                                            strchr(param_buffer, 't')) ||
+                                           (!strncmp(param_buffer, "--t", 3) &&
+                                            !strncmp(param_buffer, "--table", strlen(param_buffer)))) {
                                                xtables_error(PARAMETER_PROBLEM,
                                                           "Line %u seems to have a "
                                                           "-t table option.\n",
index 15824f0f40b5101e9672e87b02410db4a6b672d5..7e24315218321a171dac7a9277a2e48b9ca7d0a9 100644 (file)
@@ -136,8 +136,11 @@ static void add_param_to_argv(char *parsestart)
                        param_buffer[param_len] = '\0';
 
                        /* check if table name specified */
-                       if (!strncmp(param_buffer, "-t", 2)
-                           || !strncmp(param_buffer, "--table", 8)) {
+                       if ((param_buffer[0] == '-' &&
+                            param_buffer[1] != '-' &&
+                            strchr(param_buffer, 't')) ||
+                           (!strncmp(param_buffer, "--t", 3) &&
+                            !strncmp(param_buffer, "--table", strlen(param_buffer)))) {
                                xtables_error(PARAMETER_PROBLEM,
                                "The -t option (seen in line %u) cannot be "
                                "used in xtables-restore.\n", line);