* add additional checks in nfacct_cmd_add, nfacct_cmd_delete and
nfacct_cmd_get functions to prevent zero-sized string being accepted as a
command line parameter for nfacct object name;
* add a separate check for the number of command-line arguments in
nfacct_cmd_restore, preventing arbitrary parameters being specified;
Signed-off-by: Michael Zintakis <michael.zintakis@xxxxxxxxxxxxxx>
---
src/nfacct.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/src/nfacct.c b/src/nfacct.c
index 1324da7..bf50f50 100644
--- a/src/nfacct.c
+++ b/src/nfacct.c
@@ -298,7 +298,7 @@ static int _nfacct_cmd_add(char *name, uint64_t pkts, uint64_t bytes)
static int nfacct_cmd_add(int argc, char *argv[])
{
- if (argc < 3) {
+ if (argc < 3 || strlen(argv[2]) == 0) {
nfacct_perror("missing object name");
return -1;
} else if (argc > 3) {
@@ -318,7 +318,7 @@ static int nfacct_cmd_delete(int argc, char *argv[])
struct nfacct *nfacct;
int ret;
- if (argc < 3) {
+ if (argc < 3 || strlen(argv[2]) == 0) {
nfacct_perror("missing object name");
return -1;
} else if (argc > 3) {
@@ -385,7 +385,7 @@ static int nfacct_cmd_get(int argc, char *argv[])
struct nfacct *nfacct;
int ret, i;
- if (argc < 3) {
+ if (argc < 3 || strlen(argv[2]) == 0) {
nfacct_perror("missing object name");
return -1;
}
@@ -546,6 +546,11 @@ static int nfacct_cmd_restore(int argc, char *argv[])
char buffer[512];
int ret;
+ if (argc > 2) {
+ nfacct_perror("too many arguments");
+ return -1;
+ }
+
while (fgets(buffer, sizeof(buffer), stdin)) {
char *semicolon = strchr(buffer, ';');
if (semicolon == NULL) {
--
1.8.3.1
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
