From d1df0a36b0486c780211cfa574301132bf55f194 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 7 Feb 2019 22:08:53 +0100 Subject: nft: Don't assume NFTNL_RULE_USERDATA holds a comment If this rule attribute is present but does not contain a comment, get_comment() returns NULL which is then fed into strncpy() causing a crash. Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal --- iptables/nft-shared.c | 39 ++++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 17 deletions(-) (limited to 'iptables/nft-shared.c') diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c index a72d414d..1c09277d 100644 --- a/iptables/nft-shared.c +++ b/iptables/nft-shared.c @@ -639,25 +639,30 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r, if (nftnl_rule_is_set(r, NFTNL_RULE_USERDATA)) { const void *data; uint32_t len, size; - struct xtables_match *match; - struct xt_entry_match *m; + const char *comment; data = nftnl_rule_get_data(r, NFTNL_RULE_USERDATA, &len); - match = xtables_find_match("comment", XTF_TRY_LOAD, - &cs->matches); - if (match == NULL) - return; - - size = XT_ALIGN(sizeof(struct xt_entry_match)) + match->size; - m = xtables_calloc(1, size); - - strncpy((char *)m->data, get_comment(data, len), - match->size - 1); - m->u.match_size = size; - m->u.user.revision = 0; - strcpy(m->u.user.name, match->name); - - match->m = m; + comment = get_comment(data, len); + if (comment) { + struct xtables_match *match; + struct xt_entry_match *m; + + match = xtables_find_match("comment", XTF_TRY_LOAD, + &cs->matches); + if (match == NULL) + return; + + size = XT_ALIGN(sizeof(struct xt_entry_match)) + + match->size; + m = xtables_calloc(1, size); + + strncpy((char *)m->data, comment, match->size - 1); + m->u.match_size = size; + m->u.user.revision = 0; + strcpy(m->u.user.name, match->name); + + match->m = m; + } } if (cs->target != NULL) { -- cgit v1.2.3