From d0cbf5f34d3421064eb0fbbcdc6b90cda4e81f2d Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Mon, 4 Aug 2008 12:51:01 +0200 Subject: iptables-restore: fix segmentation fault with -tanything Reference: Debian bug #458042 iptables-restore must not pass a table into do_command. It checks for "-t arg" and "--table arg", but not "-targ". (On a related note, using -targ does not work as expected). This should fail gracefully, but crashes: iptables-restore <(echo -e '*filter\n-A INPUT -tx\nCOMMIT') And this should use table "filter", or perhaps raise an error, but instead sets the table to (literally) "-tfilter": iptables -tfilter -A INPUT Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy --- ip6tables-restore.c | 2 +- ip6tables.c | 5 ++--- iptables-restore.c | 2 +- iptables.c | 5 ++--- 4 files changed, 6 insertions(+), 8 deletions(-) diff --git a/ip6tables-restore.c b/ip6tables-restore.c index cd6dd032..f51e38f1 100644 --- a/ip6tables-restore.c +++ b/ip6tables-restore.c @@ -406,7 +406,7 @@ int main(int argc, char *argv[]) param_buffer[param_len] = '\0'; /* check if table name specified */ - if (!strncmp(param_buffer, "-t", 3) + if (!strncmp(param_buffer, "-t", 2) || !strncmp(param_buffer, "--table", 8)) { exit_error(PARAMETER_PROBLEM, "Line %u seems to have a " diff --git a/ip6tables.c b/ip6tables.c index 2b053924..283a1c2d 100644 --- a/ip6tables.c +++ b/ip6tables.c @@ -1747,7 +1747,7 @@ int do_command6(int argc, char *argv[], char **table, ip6tc_handle_t *handle) if (invert) exit_error(PARAMETER_PROBLEM, "unexpected ! flag before --table"); - *table = argv[optind-1]; + *table = optarg; break; case 'x': @@ -1890,8 +1890,7 @@ int do_command6(int argc, char *argv[], char **table, ip6tc_handle_t *handle) if (!m) exit_error(PARAMETER_PROBLEM, - "Unknown arg `%s'", - argv[optind-1]); + "Unknown arg `%s'", optarg); } } invert = FALSE; diff --git a/iptables-restore.c b/iptables-restore.c index 4b199d94..dcbed149 100644 --- a/iptables-restore.c +++ b/iptables-restore.c @@ -412,7 +412,7 @@ main(int argc, char *argv[]) param_buffer[param_len] = '\0'; /* check if table name specified */ - if (!strncmp(param_buffer, "-t", 3) + if (!strncmp(param_buffer, "-t", 2) || !strncmp(param_buffer, "--table", 8)) { exit_error(PARAMETER_PROBLEM, "Line %u seems to have a " diff --git a/iptables.c b/iptables.c index bf3cbca2..41e18361 100644 --- a/iptables.c +++ b/iptables.c @@ -1764,7 +1764,7 @@ int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle) if (invert) exit_error(PARAMETER_PROBLEM, "unexpected ! flag before --table"); - *table = argv[optind-1]; + *table = optarg; break; case 'x': @@ -1911,8 +1911,7 @@ int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle) } if (!m) exit_error(PARAMETER_PROBLEM, - "Unknown arg `%s'", - argv[optind-1]); + "Unknown arg `%s'", optarg); } } invert = FALSE; -- cgit v1.2.3