diff options
author | Oliver Ford <ojford@gmail.com> | 2017-05-19 12:02:26 +0000 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-05-29 13:42:23 +0200 |
commit | f8e5ebc5986bffa682ed9e4497e3c19f19bf961e (patch) | |
tree | 84e7838b63a8f4132fa6803d698b3c049f7c5721 | |
parent | 80d8bfaac9e2430d710084a10ec78e68bd61e6ec (diff) |
iptables: Fix crash on malformed iptables-restore
Fixes the crash reported in Bugzilla #1131 where a malformed parameter that
specifies the table option during a restore can create an invalid pointer.
It was discovered during fuzz testing that options like '-ftf'
can cause a segfault. A parameter that includes a 't' is not currently
filtered correctly.
Improves the filtering to:
Filter a beginning '-' followed by a character other than '-' and then a 't'
anywhere in the parameter. This filters parameters like '-ftf'.
Filter '--t'.
Filter '--table', stopping when the parameter length is reached. Because the
getopt_long function allows abbreviations, any unique abbreviation of '--table'
will be treated as '--table'. This filters parameters like '--t', '--ta', but not
'--ttl' or '--target'.
Signed-off-by: Oliver Ford <ojford@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r-- | iptables/ip6tables-restore.c | 7 | ||||
-rw-r--r-- | iptables/iptables-restore.c | 7 | ||||
-rw-r--r-- | iptables/iptables-xml.c | 8 | ||||
-rw-r--r-- | iptables/xtables-restore.c | 7 |
4 files changed, 20 insertions, 9 deletions
diff --git a/iptables/ip6tables-restore.c b/iptables/ip6tables-restore.c index 1e50bf0d..eaa2bcbc 100644 --- a/iptables/ip6tables-restore.c +++ b/iptables/ip6tables-restore.c @@ -165,8 +165,11 @@ static void add_param_to_argv(char *parsestart) param_buffer[param_len] = '\0'; /* check if table name specified */ - if (!strncmp(param_buffer, "-t", 2) - || !strncmp(param_buffer, "--table", 8)) { + if ((param_buffer[0] == '-' && + param_buffer[1] != '-' && + strchr(param_buffer, 't')) || + (!strncmp(param_buffer, "--t", 3) && + !strncmp(param_buffer, "--table", strlen(param_buffer)))) { xtables_error(PARAMETER_PROBLEM, "The -t option (seen in line %u) cannot be " "used in ip6tables-restore.\n", line); diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c index d79fe328..9dbfc572 100644 --- a/iptables/iptables-restore.c +++ b/iptables/iptables-restore.c @@ -162,8 +162,11 @@ static void add_param_to_argv(char *parsestart) param_buffer[param_len] = '\0'; /* check if table name specified */ - if (!strncmp(param_buffer, "-t", 2) - || !strncmp(param_buffer, "--table", 8)) { + if ((param_buffer[0] == '-' && + param_buffer[1] != '-' && + strchr(param_buffer, 't')) || + (!strncmp(param_buffer, "--t", 3) && + !strncmp(param_buffer, "--table", strlen(param_buffer)))) { xtables_error(PARAMETER_PROBLEM, "The -t option (seen in line %u) cannot be " "used in iptables-restore.\n", line); diff --git a/iptables/iptables-xml.c b/iptables/iptables-xml.c index 2e093b54..56b8372b 100644 --- a/iptables/iptables-xml.c +++ b/iptables/iptables-xml.c @@ -819,9 +819,11 @@ iptables_xml_main(int argc, char *argv[]) *(param_buffer + param_len) = '\0'; /* check if table name specified */ - if (!strncmp(param_buffer, "-t", 3) - || !strncmp(param_buffer, - "--table", 8)) { + if ((param_buffer[0] == '-' && + param_buffer[1] != '-' && + strchr(param_buffer, 't')) || + (!strncmp(param_buffer, "--t", 3) && + !strncmp(param_buffer, "--table", strlen(param_buffer)))) { xtables_error(PARAMETER_PROBLEM, "Line %u seems to have a " "-t table option.\n", diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c index 15824f0f..7e243152 100644 --- a/iptables/xtables-restore.c +++ b/iptables/xtables-restore.c @@ -136,8 +136,11 @@ static void add_param_to_argv(char *parsestart) param_buffer[param_len] = '\0'; /* check if table name specified */ - if (!strncmp(param_buffer, "-t", 2) - || !strncmp(param_buffer, "--table", 8)) { + if ((param_buffer[0] == '-' && + param_buffer[1] != '-' && + strchr(param_buffer, 't')) || + (!strncmp(param_buffer, "--t", 3) && + !strncmp(param_buffer, "--table", strlen(param_buffer)))) { xtables_error(PARAMETER_PROBLEM, "The -t option (seen in line %u) cannot be " "used in xtables-restore.\n", line); |