On Wed, May 17, 2017 at 11:19 PM, Florian Westphal <fw@xxxxxxxxx> wrote:
> Oliver Ford <ojford@xxxxxxxxx> wrote:
>> Fixes the crash reported in Bugzilla #1131 where a malformed
>> parameter that specifies the table option can create an invalid
>> pointer.
>>
>> Improves the tables option check to find a beginning '-' followed by
>> a 't' anywhere in the parameter.
>
>> diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
>> index 876fe06..70dc7eb 100644
>> --- a/iptables/iptables-restore.c
>> +++ b/iptables/iptables-restore.c
>> @@ -162,8 +162,7 @@ static void add_param_to_argv(char *parsestart)
>> param_buffer[param_len] = '\0';
>>
>> /* check if table name specified */
>> - if (!strncmp(param_buffer, "-t", 2)
>> - || !strncmp(param_buffer, "--table", 8)) {
>> + if (param_buffer[0] == '-' && strchr(param_buffer, 't')) {
>> xtables_error(PARAMETER_PROBLEM,
>> "The -t option (seen in line %u) cannot be "
>> "used in iptables-restore.\n", line);
>
> strchr() can only called if param_buffer[1] != '-', else this breaks
> something like:
>
> # Generated by iptables-save v1.6.0 on Thu May 18 00:00:38 2017
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> --delete foo
> COMMIT
>
> (use '-n' option to iptables).
Good point I'll check for that and send an updated patch.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
