From aeabb1640ffb5643729ca2ce343738cd85b65f3f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Gr=C3=B6ber?= Date: Wed, 24 Jun 2020 15:30:02 +0200 Subject: conntrack: Fix buffer overflow on invalid icmp type in setters MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When type is out of range for the invmap_icmp{,v6} array we leave rtype at zero which will map to type=255 just like other error cases in this function. Signed-off-by: Daniel Gröber Signed-off-by: Pablo Neira Ayuso --- src/conntrack/grp_setter.c | 8 +++++--- src/conntrack/setter.c | 11 +++++++---- 2 files changed, 12 insertions(+), 7 deletions(-) (limited to 'src') diff --git a/src/conntrack/grp_setter.c b/src/conntrack/grp_setter.c index fccf578..4f0125b 100644 --- a/src/conntrack/grp_setter.c +++ b/src/conntrack/grp_setter.c @@ -85,18 +85,20 @@ static void set_attr_grp_repl_port(struct nf_conntrack *ct, const void *value) static void set_attr_grp_icmp(struct nf_conntrack *ct, const void *value) { - uint8_t rtype; const struct nfct_attr_grp_icmp *this = value; + uint8_t rtype = 0; ct->head.orig.l4dst.icmp.type = this->type; switch(ct->head.orig.l3protonum) { case AF_INET: - rtype = invmap_icmp[this->type]; + if (this->type < ARRAY_SIZE(invmap_icmp)) + rtype = invmap_icmp[this->type]; break; case AF_INET6: - rtype = invmap_icmpv6[this->type - 128]; + if (this->type - 128 < ARRAY_SIZE(invmap_icmp)) + rtype = invmap_icmpv6[this->type - 128]; break; default: diff --git a/src/conntrack/setter.c b/src/conntrack/setter.c index 3a293b0..1d3b971 100644 --- a/src/conntrack/setter.c +++ b/src/conntrack/setter.c @@ -124,17 +124,20 @@ set_attr_repl_zone(struct nf_conntrack *ct, const void *value, size_t len) static void set_attr_icmp_type(struct nf_conntrack *ct, const void *value, size_t len) { - uint8_t rtype; + uint8_t type = *((uint8_t *) value); + uint8_t rtype = 0; - ct->head.orig.l4dst.icmp.type = *((uint8_t *) value); + ct->head.orig.l4dst.icmp.type = type; switch(ct->head.orig.l3protonum) { case AF_INET: - rtype = invmap_icmp[*((uint8_t *) value)]; + if (type < ARRAY_SIZE(invmap_icmp)) + rtype = invmap_icmp[type]; break; case AF_INET6: - rtype = invmap_icmpv6[*((uint8_t *) value) - 128]; + if (type - 128 < ARRAY_SIZE(invmap_icmpv6)) + rtype = invmap_icmpv6[type - 128]; break; default: -- cgit v1.2.3