]> git.ipfire.org Git - thirdparty/nftables.git/commit
meta: fix tc classid parsing out-of-bounds access
authorFlorian Westphal <fw@strlen.de>
Wed, 13 Dec 2023 16:37:11 +0000 (17:37 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Sun, 27 Jul 2025 21:26:19 +0000 (23:26 +0200)
commit801a06aece44d4954df03bd0e61c3e2e9ee557e9
tree4ff99a88a1fbcf1e7c9c0c27ab8b05d595fac09c
parent6566ed53a7768216c5de7acd8e559d8cf5f8c0ab
meta: fix tc classid parsing out-of-bounds access

commit 7008b1200fb4988b7cd7ee1c5399cae071688d50 upstream.

AddressSanitizer: heap-buffer-overflow on address 0x6020000003af ...
  #0 0x7f9a83cbb402 in tchandle_type_parse src/meta.c:89
  #1 0x7f9a83c6753f in symbol_parse src/datatype.c:138

strlen() - 1 can underflow if length was 0.

Simplify the function, there is no need to duplicate the string
while scanning it.

Expect the first strtol to stop at ':', scan for the minor number next.
The second scan is required to stop at '\0'.

Fixes: 6f2eb8548e0d ("src: meta priority support using tc classid")
Signed-off-by: Florian Westphal <fw@strlen.de>
src/meta.c
tests/shell/testcases/bogons/nft-f/tchandle_type_parse_heap_overflow [new file with mode: 0644]