You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
62 lines
2.2 KiB
62 lines
2.2 KiB
From 5790cacab5a3fd7bde26056fa0f8b4650bd21bb7 Mon Sep 17 00:00:00 2001 |
|
From: Phil Sutter <psutter@redhat.com> |
|
Date: Fri, 15 Mar 2019 17:50:10 +0100 |
|
Subject: [PATCH] libxt_string: Fix array out of bounds check |
|
|
|
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1525980 |
|
Upstream Status: iptables commit 6fc7762f6f785 |
|
|
|
commit 6fc7762f6f78526e3cb0c189ac2778a6be4c00b5 |
|
Author: Phil Sutter <phil@nwl.cc> |
|
Date: Mon Sep 17 13:38:33 2018 +0200 |
|
|
|
libxt_string: Fix array out of bounds check |
|
|
|
Commit 56d7ab42f3782 ("libxt_string: Avoid potential array out of bounds |
|
access") tried to fix parse_hex_string() for overlong strings but the |
|
change still allowed for 'sindex' to become XT_STRING_MAX_PATTERN_SIZE |
|
which leads to access of first byte after info->pattern. This is not |
|
really a problem because it merely overwrites info->patlen before |
|
calling xtables_error() later, but covscan still detects it so it's |
|
still worth fixing. |
|
|
|
The crucial bit here is that 'sindex' has to be incremented at end of |
|
the last iteration since its value is used for info->patlen. Hence just |
|
move the overflow check to the beginning of the loop. |
|
|
|
Fixes: 56d7ab42f3782 ("libxt_string: Avoid potential array out of bounds access") |
|
Signed-off-by: Phil Sutter <phil@nwl.cc> |
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
|
|
|
Signed-off-by: Phil Sutter <psutter@redhat.com> |
|
--- |
|
extensions/libxt_string.c | 6 ++++-- |
|
1 file changed, 4 insertions(+), 2 deletions(-) |
|
|
|
diff --git a/extensions/libxt_string.c b/extensions/libxt_string.c |
|
index d298c6a7081e7..7c6366cbbf1b3 100644 |
|
--- a/extensions/libxt_string.c |
|
+++ b/extensions/libxt_string.c |
|
@@ -103,6 +103,9 @@ parse_hex_string(const char *s, struct xt_string_info *info) |
|
} |
|
|
|
while (i < slen) { |
|
+ if (sindex >= XT_STRING_MAX_PATTERN_SIZE) |
|
+ xtables_error(PARAMETER_PROBLEM, |
|
+ "STRING too long \"%s\"", s); |
|
if (s[i] == '\\' && !hex_f) { |
|
literal_f = 1; |
|
} else if (s[i] == '\\') { |
|
@@ -159,8 +162,7 @@ parse_hex_string(const char *s, struct xt_string_info *info) |
|
info->pattern[sindex] = s[i]; |
|
i++; |
|
} |
|
- if (++sindex > XT_STRING_MAX_PATTERN_SIZE) |
|
- xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s); |
|
+ sindex++; |
|
} |
|
info->patlen = sindex; |
|
} |
|
-- |
|
2.21.0 |
|
|
|
|