diff options
| author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-10-11 22:22:27 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-10-17 17:32:36 +0200 |
| commit | 62064f6a9e054739ecbdda010dbe9c3fd69bbaa2 (patch) | |
| tree | 8c0f31f38db64613c748cd8b559ff398e6f837a1 /filter/raw2packet/ulogd_raw2packet_BASE.c | |
| parent | 2c3dbe92b5eab4702ced403e4f6c030249a308c2 (diff) | |
ulogd: fix crash when ipv4 packet is truncated
If ipv4 packet is truncated, we should not try to dereference the
iph pointer. Otherwise, if the user add such iptables rules
"-j NFLOG --nflog-size 0", we will dereference the NULL pointer
and crash may happen.
Reported-by: Chris Caputo <ccaputo@alt.net>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'filter/raw2packet/ulogd_raw2packet_BASE.c')
| -rw-r--r-- | filter/raw2packet/ulogd_raw2packet_BASE.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/filter/raw2packet/ulogd_raw2packet_BASE.c b/filter/raw2packet/ulogd_raw2packet_BASE.c index 8a6180c..fd2665a 100644 --- a/filter/raw2packet/ulogd_raw2packet_BASE.c +++ b/filter/raw2packet/ulogd_raw2packet_BASE.c @@ -717,7 +717,7 @@ static int _interp_iphdr(struct ulogd_pluginstance *pi, uint32_t len) struct ulogd_key *ret = pi->output.keys; struct iphdr *iph = ikey_get_ptr(&pi->input.keys[INKEY_RAW_PCKT]); - void *nexthdr = (uint32_t *)iph + iph->ihl; + void *nexthdr; if (len < sizeof(struct iphdr) || len <= (uint32_t)(iph->ihl * 4)) return ULOGD_IRET_OK; @@ -734,6 +734,7 @@ static int _interp_iphdr(struct ulogd_pluginstance *pi, uint32_t len) okey_set_u16(&ret[KEY_IP_ID], ntohs(iph->id)); okey_set_u16(&ret[KEY_IP_FRAGOFF], ntohs(iph->frag_off)); + nexthdr = (uint32_t *)iph + iph->ihl; switch (iph->protocol) { case IPPROTO_TCP: _interp_tcp(pi, nexthdr, len); |