summaryrefslogtreecommitdiffstats
path: root/iptables.c
diff options
context:
space:
mode:
authorJan Engelhardt <jengelh@medozas.de>2011-01-08 02:25:28 +0100
committerJan Engelhardt <jengelh@medozas.de>2011-01-08 02:25:28 +0100
commit1e128bd804b676ee91beca48312de9b251845d09 (patch)
tree1bfa22e4d173cd1774f2510acec84ca0124829f7 /iptables.c
parent1dc27393b7ba401e6228a5ee2472a6eb72836c43 (diff)
ip[6]tables: only call match's parse function when option char is in range
Normally, extensions use a "default:" case in switch(c) to just return if they do not handle c. Apparently, libip6t_hl does that too late and checks for hl-specific parsing state before it has established that c refers to one of its own options. Also affected: libipt_ttl, libxt_ipvs, libxt_policy, libxt_statistic. One way to fix this is to move the flags checks into case '2', '3', '4'. Doing this replication feels bad, so as an alternative, let's just free extensions from having to deal with other extension's options passing thru. References: http://marc.info/?l=netfilter-devel&m=129444759532377&w=2 Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Diffstat (limited to 'iptables.c')
-rw-r--r--iptables.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/iptables.c b/iptables.c
index e0efbf1b..bcacd49f 100644
--- a/iptables.c
+++ b/iptables.c
@@ -1746,6 +1746,9 @@ int do_command(int argc, char *argv[], char **table, struct iptc_handle **handle
if (matchp->completed ||
matchp->match->parse == NULL)
continue;
+ if (c < matchp->match->option_offset ||
+ c >= matchp->match->option_offset + XT_OPTION_OFFSET_SCALE)
+ continue;
if (matchp->match->parse(c - matchp->match->option_offset,
argv, invert,
&matchp->match->mflags,