diff options
| author | Florian Westphal <fw@strlen.de> | 2023-12-12 19:13:14 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-12-15 02:27:14 +0100 |
| commit | ef10d65db278d77208e960d210a1f4f532ebb552 (patch) | |
| tree | 354f10077f748e440f15b205071610c7c1f273b3 /tests | |
| parent | 8eeedce89d8bf0ad58da398782c2ca8a91d83a32 (diff) | |
src: reject large raw payload and concat expressions
The kernel will reject this too, but unfortunately nft may try
to cram the data into the underlying libnftnl expr.
This causes heap corruption or
BUG: nld buffer overflow: want to copy 132, max 64
After:
Error: Concatenation of size 544 exceeds maximum size of 512
udp length . @th,0,512 . @th,512,512 { 47-63 . 0xe373135363130 . 0x33131303735353203 }
^^^^^^^^^
resp. same warning for an over-sized raw expression.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/shell/testcases/bogons/nft-f/stack_overflow_via_large_concat_expr | 5 | ||||
| -rw-r--r-- | tests/shell/testcases/bogons/nft-f/stack_overflow_via_large_raw_expr | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/tests/shell/testcases/bogons/nft-f/stack_overflow_via_large_concat_expr b/tests/shell/testcases/bogons/nft-f/stack_overflow_via_large_concat_expr new file mode 100644 index 00000000..8b0d2744 --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/stack_overflow_via_large_concat_expr @@ -0,0 +1,5 @@ +table t { + chain c { + udp length . @th,0,512 . @th,512,512 { 47-63 . 0xe373135363130 . 0x33131303735353203 } + } +} diff --git a/tests/shell/testcases/bogons/nft-f/stack_overflow_via_large_raw_expr b/tests/shell/testcases/bogons/nft-f/stack_overflow_via_large_raw_expr new file mode 100644 index 00000000..66bd6bf8 --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/stack_overflow_via_large_raw_expr @@ -0,0 +1,5 @@ +table t { + chain c { + @th,160,1272 gt 0 + } +} |