From f8e5ebc5986bffa682ed9e4497e3c19f19bf961e Mon Sep 17 00:00:00 2001 From: Oliver Ford Date: Fri, 19 May 2017 12:02:26 +0000 Subject: iptables: Fix crash on malformed iptables-restore Fixes the crash reported in Bugzilla #1131 where a malformed parameter that specifies the table option during a restore can create an invalid pointer. It was discovered during fuzz testing that options like '-ftf' can cause a segfault. A parameter that includes a 't' is not currently filtered correctly. Improves the filtering to: Filter a beginning '-' followed by a character other than '-' and then a 't' anywhere in the parameter. This filters parameters like '-ftf'. Filter '--t'. Filter '--table', stopping when the parameter length is reached. Because the getopt_long function allows abbreviations, any unique abbreviation of '--table' will be treated as '--table'. This filters parameters like '--t', '--ta', but not '--ttl' or '--target'. Signed-off-by: Oliver Ford Signed-off-by: Pablo Neira Ayuso --- iptables/iptables-restore.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'iptables/iptables-restore.c') diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c index d79fe328..9dbfc572 100644 --- a/iptables/iptables-restore.c +++ b/iptables/iptables-restore.c @@ -162,8 +162,11 @@ static void add_param_to_argv(char *parsestart) param_buffer[param_len] = '\0'; /* check if table name specified */ - if (!strncmp(param_buffer, "-t", 2) - || !strncmp(param_buffer, "--table", 8)) { + if ((param_buffer[0] == '-' && + param_buffer[1] != '-' && + strchr(param_buffer, 't')) || + (!strncmp(param_buffer, "--t", 3) && + !strncmp(param_buffer, "--table", strlen(param_buffer)))) { xtables_error(PARAMETER_PROBLEM, "The -t option (seen in line %u) cannot be " "used in iptables-restore.\n", line); -- cgit v1.2.3