laurenceman / rpms / iptables

Forked from rpms/iptables 5 years ago
Clone

Blame SOURCES/0051-nft-Don-t-assume-NFTNL_RULE_USERDATA-holds-a-comment.patch

029dc7
From e78321d1a719a5dc1b340292fc1971d4daf7e472 Mon Sep 17 00:00:00 2001
029dc7
From: Phil Sutter <phil@nwl.cc>
029dc7
Date: Thu, 7 Feb 2019 22:08:53 +0100
029dc7
Subject: [PATCH] nft: Don't assume NFTNL_RULE_USERDATA holds a comment
029dc7
029dc7
If this rule attribute is present but does not contain a comment,
029dc7
get_comment() returns NULL which is then fed into strncpy() causing a
029dc7
crash.
029dc7
029dc7
Signed-off-by: Phil Sutter <phil@nwl.cc>
029dc7
Signed-off-by: Florian Westphal <fw@strlen.de>
029dc7
(cherry picked from commit d1df0a36b0486c780211cfa574301132bf55f194)
029dc7
Signed-off-by: Phil Sutter <psutter@redhat.com>
029dc7
---
029dc7
 iptables/nft-shared.c | 39 ++++++++++++++++++++++-----------------
029dc7
 1 file changed, 22 insertions(+), 17 deletions(-)
029dc7
029dc7
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
029dc7
index ce40787f92f7d..fc484b49e2318 100644
029dc7
--- a/iptables/nft-shared.c
029dc7
+++ b/iptables/nft-shared.c
029dc7
@@ -639,25 +639,30 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r,
029dc7
 	if (nftnl_rule_is_set(r, NFTNL_RULE_USERDATA)) {
029dc7
 		const void *data;
029dc7
 		uint32_t len, size;
029dc7
-		struct xtables_match *match;
029dc7
-		struct xt_entry_match *m;
029dc7
+		const char *comment;
029dc7
 
029dc7
 		data = nftnl_rule_get_data(r, NFTNL_RULE_USERDATA, &len;;
029dc7
-		match = xtables_find_match("comment", XTF_TRY_LOAD,
029dc7
-					   &cs->matches);
029dc7
-		if (match == NULL)
029dc7
-			return;
029dc7
-
029dc7
-		size = XT_ALIGN(sizeof(struct xt_entry_match)) + match->size;
029dc7
-		m = xtables_calloc(1, size);
029dc7
-
029dc7
-		strncpy((char *)m->data, get_comment(data, len),
029dc7
-			match->size - 1);
029dc7
-		m->u.match_size = size;
029dc7
-		m->u.user.revision = 0;
029dc7
-		strcpy(m->u.user.name, match->name);
029dc7
-
029dc7
-		match->m = m;
029dc7
+		comment = get_comment(data, len);
029dc7
+		if (comment) {
029dc7
+			struct xtables_match *match;
029dc7
+			struct xt_entry_match *m;
029dc7
+
029dc7
+			match = xtables_find_match("comment", XTF_TRY_LOAD,
029dc7
+						   &cs->matches);
029dc7
+			if (match == NULL)
029dc7
+				return;
029dc7
+
029dc7
+			size = XT_ALIGN(sizeof(struct xt_entry_match))
029dc7
+				+ match->size;
029dc7
+			m = xtables_calloc(1, size);
029dc7
+
029dc7
+			strncpy((char *)m->data, comment, match->size - 1);
029dc7
+			m->u.match_size = size;
029dc7
+			m->u.user.revision = 0;
029dc7
+			strcpy(m->u.user.name, match->name);
029dc7
+
029dc7
+			match->m = m;
029dc7
+		}
029dc7
 	}
029dc7
 
029dc7
 	if (cs->target != NULL) {
029dc7
-- 
029dc7
2.21.0
029dc7