path: root/iptables/xtables-restore.c
diff options
authorOliver Ford <>2017-05-19 12:02:26 +0000
committerPablo Neira Ayuso <>2017-05-29 13:42:23 +0200
commitf8e5ebc5986bffa682ed9e4497e3c19f19bf961e (patch)
tree84e7838b63a8f4132fa6803d698b3c049f7c5721 /iptables/xtables-restore.c
parent80d8bfaac9e2430d710084a10ec78e68bd61e6ec (diff)
iptables: Fix crash on malformed iptables-restore
Fixes the crash reported in Bugzilla #1131 where a malformed parameter that specifies the table option during a restore can create an invalid pointer. It was discovered during fuzz testing that options like '-ftf' can cause a segfault. A parameter that includes a 't' is not currently filtered correctly. Improves the filtering to: Filter a beginning '-' followed by a character other than '-' and then a 't' anywhere in the parameter. This filters parameters like '-ftf'. Filter '--t'. Filter '--table', stopping when the parameter length is reached. Because the getopt_long function allows abbreviations, any unique abbreviation of '--table' will be treated as '--table'. This filters parameters like '--t', '--ta', but not '--ttl' or '--target'. Signed-off-by: Oliver Ford <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'iptables/xtables-restore.c')
1 files changed, 5 insertions, 2 deletions
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index 15824f0f..7e243152 100644
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -136,8 +136,11 @@ static void add_param_to_argv(char *parsestart)
param_buffer[param_len] = '\0';
/* check if table name specified */
- if (!strncmp(param_buffer, "-t", 2)
- || !strncmp(param_buffer, "--table", 8)) {
+ if ((param_buffer[0] == '-' &&
+ param_buffer[1] != '-' &&
+ strchr(param_buffer, 't')) ||
+ (!strncmp(param_buffer, "--t", 3) &&
+ !strncmp(param_buffer, "--table", strlen(param_buffer)))) {
"The -t option (seen in line %u) cannot be "
"used in xtables-restore.\n", line);