diff options
| author | Florian Westphal <fw@strlen.de> | 2024-01-12 13:27:23 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2024-01-12 15:25:09 +0100 |
| commit | e08627257ecfa7dfb68a34a1c8866e7a7e012b15 (patch) | |
| tree | 9f52d78746046499683074df97782779c2a5b2f7 /src/parser_json.c | |
| parent | 9cc41467c75ab6beb35e0d7c34d04acd1a44861b (diff) | |
parser: reject raw payload expressions with 0 length
Reject this at parser stage. Fix up the json input side too, else
reproducer gives:
nft: src/netlink.c:243: netlink_gen_raw_data: Assertion `len > 0' failed.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/parser_json.c')
| -rw-r--r-- | src/parser_json.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/src/parser_json.c b/src/parser_json.c index 9e02bc34..a0c9318c 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -592,6 +592,13 @@ static struct expr *json_parse_payload_expr(struct json_ctx *ctx, json_error(ctx, "Invalid payload base '%s'.", base); return NULL; } + + if (len <= 0 || len > (int)NFT_MAX_EXPR_LEN_BITS) { + json_error(ctx, "Payload length must be between 0 and %lu, got %d", + NFT_MAX_EXPR_LEN_BITS, len); + return NULL; + } + expr = payload_expr_alloc(int_loc, NULL, 0); payload_init_raw(expr, val, offset, len); expr->byteorder = BYTEORDER_BIG_ENDIAN; @@ -663,6 +670,12 @@ static struct expr *json_parse_tcp_option_expr(struct json_ctx *ctx, if (kind < 0 || kind > 255) return NULL; + if (len <= 0 || len > (int)NFT_MAX_EXPR_LEN_BITS) { + json_error(ctx, "option length must be between 0 and %lu, got %d", + NFT_MAX_EXPR_LEN_BITS, len); + return NULL; + } + expr = tcpopt_expr_alloc(int_loc, kind, TCPOPT_COMMON_KIND); |