From e6f986762667ee2b2d61e7978d460f28916158a3 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 10 Sep 2018 23:35:14 +0200 Subject: libiptc: Avoid side-effect in memset() calls These calls to memset() are passed a length argument which exceeds t->target.u.user.name's length by one byte and hence overwrite t->target.u.user.revision as well (relying upon no padding to happen between both). Avoid this obscure behaviour by passing the correct field size and explicitly overwriting 'revision' field. Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal --- libiptc/libiptc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'libiptc') diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c index a6e70571..6eacdddd 100644 --- a/libiptc/libiptc.c +++ b/libiptc/libiptc.c @@ -1115,8 +1115,9 @@ static inline int iptcc_compile_rule (struct xtc_handle *h, STRUCT_REPLACE *repl STRUCT_STANDARD_TARGET *t; t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry); /* memset for memcmp convenience on delete/replace */ - memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN); + memset(t->target.u.user.name, 0, XT_EXTENSION_MAXNAMELEN); strcpy(t->target.u.user.name, STANDARD_TARGET); + t->target.u.user.revision = 0; /* Jumps can only happen to builtin chains, so we * can safely assume that they always have a header */ t->verdict = r->jump->head_offset + IPTCB_CHAIN_START_SIZE; @@ -1675,8 +1676,9 @@ iptcc_standard_map(struct rule_head *r, int verdict) return 0; } /* memset for memcmp convenience on delete/replace */ - memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN); + memset(t->target.u.user.name, 0, XT_EXTENSION_MAXNAMELEN); strcpy(t->target.u.user.name, STANDARD_TARGET); + t->target.u.user.revision = 0; t->verdict = verdict; r->type = IPTCC_R_STANDARD; -- cgit v1.2.3