You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
63 lines
2.2 KiB
63 lines
2.2 KiB
4 years ago
|
From 5790cacab5a3fd7bde26056fa0f8b4650bd21bb7 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Phil Sutter <psutter@redhat.com>
|
||
|
|
Date: Fri, 15 Mar 2019 17:50:10 +0100
|
||
|
|
Subject: [PATCH] libxt_string: Fix array out of bounds check
|
||
|
|
|
||
|
|
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1525980
|
||
|
|
Upstream Status: iptables commit 6fc7762f6f785
|
||
|
|
|
||
|
|
commit 6fc7762f6f78526e3cb0c189ac2778a6be4c00b5
|
||
|
|
Author: Phil Sutter <phil@nwl.cc>
|
||
|
|
Date: Mon Sep 17 13:38:33 2018 +0200
|
||
|
|
|
||
|
|
libxt_string: Fix array out of bounds check
|
||
|
|
|
||
|
|
Commit 56d7ab42f3782 ("libxt_string: Avoid potential array out of bounds
|
||
|
|
access") tried to fix parse_hex_string() for overlong strings but the
|
||
|
|
change still allowed for 'sindex' to become XT_STRING_MAX_PATTERN_SIZE
|
||
|
|
which leads to access of first byte after info->pattern. This is not
|
||
|
|
really a problem because it merely overwrites info->patlen before
|
||
|
|
calling xtables_error() later, but covscan still detects it so it's
|
||
|
|
still worth fixing.
|
||
|
|
|
||
|
|
The crucial bit here is that 'sindex' has to be incremented at end of
|
||
|
|
the last iteration since its value is used for info->patlen. Hence just
|
||
|
|
move the overflow check to the beginning of the loop.
|
||
|
|
|
||
|
|
Fixes: 56d7ab42f3782 ("libxt_string: Avoid potential array out of bounds access")
|
||
|
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||
|
|
|
||
|
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||
|
|
---
|
||
|
|
extensions/libxt_string.c | 6 ++++--
|
||
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/extensions/libxt_string.c b/extensions/libxt_string.c
|
||
|
|
index d298c6a7081e7..7c6366cbbf1b3 100644
|
||
|
|
--- a/extensions/libxt_string.c
|
||
|
|
+++ b/extensions/libxt_string.c
|
||
|
|
@@ -103,6 +103,9 @@ parse_hex_string(const char *s, struct xt_string_info *info)
|
||
|
|
}
|
||
|
|
|
||
|
|
while (i < slen) {
|
||
|
|
+ if (sindex >= XT_STRING_MAX_PATTERN_SIZE)
|
||
|
|
+ xtables_error(PARAMETER_PROBLEM,
|
||
|
|
+ "STRING too long \"%s\"", s);
|
||
|
|
if (s[i] == '\\' && !hex_f) {
|
||
|
|
literal_f = 1;
|
||
|
|
} else if (s[i] == '\\') {
|
||
|
|
@@ -159,8 +162,7 @@ parse_hex_string(const char *s, struct xt_string_info *info)
|
||
|
|
info->pattern[sindex] = s[i];
|
||
|
|
i++;
|
||
|
|
}
|
||
|
|
- if (++sindex > XT_STRING_MAX_PATTERN_SIZE)
|
||
|
|
- xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s);
|
||
|
|
+ sindex++;
|
||
|
|
}
|
||
|
|
info->patlen = sindex;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.21.0
|
||
|
|
|