Oliver Ford <ojford@xxxxxxxxx> wrote:
> Fixes the crash reported in Bugzilla #1131 where a malformed
> parameter that specifies the table option can create an invalid
> pointer.
>
> Improves the tables option check to find a beginning '-' followed by
> a 't' anywhere in the parameter.
> diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
> index 876fe06..70dc7eb 100644
> --- a/iptables/iptables-restore.c
> +++ b/iptables/iptables-restore.c
> @@ -162,8 +162,7 @@ static void add_param_to_argv(char *parsestart)
> param_buffer[param_len] = '\0';
>
> /* check if table name specified */
> - if (!strncmp(param_buffer, "-t", 2)
> - || !strncmp(param_buffer, "--table", 8)) {
> + if (param_buffer[0] == '-' && strchr(param_buffer, 't')) {
> xtables_error(PARAMETER_PROBLEM,
> "The -t option (seen in line %u) cannot be "
> "used in iptables-restore.\n", line);
strchr() can only called if param_buffer[1] != '-', else this breaks
something like:
# Generated by iptables-save v1.6.0 on Thu May 18 00:00:38 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
--delete foo
COMMIT
(use '-n' option to iptables).
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
