|
 |
9a3fa7 |
From c360c1d2af887c8e614ec152fb64717e56fb472d Mon Sep 17 00:00:00 2001
|
|
|
9a3fa7 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
9a3fa7 |
Date: Tue, 9 Apr 2019 15:22:44 +0200
|
|
|
9a3fa7 |
Subject: [PATCH] iptables-xml: fix segfault if missing space after -A
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1525980
|
|
|
9a3fa7 |
Upstream Status: iptables commit f53b78e423d82
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
commit f53b78e423d82b0c71c076480f52edeb5eaec5f8
|
|
|
9a3fa7 |
Author: Phil Oester <kernel@linuxace.com>
|
|
|
9a3fa7 |
Date: Thu Jan 23 22:06:58 2014 -0800
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
iptables-xml: fix segfault if missing space after -A
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
As pointed out by Bernhard Reutner-Fischer, a malformed line fed to
|
|
|
9a3fa7 |
iptables-xml such as the below with a missing space after the -A:
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
-APOSTROUTING -d 1.1.1.1/32 -p tcp -j MASQUERADE
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
causes a segfault. Patch attached.
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
This closes netfilter bugzilla #886.
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
Signed-off-by: Phil Oester <kernel@linuxace.com>
|
|
|
9a3fa7 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
9a3fa7 |
---
|
|
|
9a3fa7 |
iptables/iptables-xml.c | 5 +++++
|
|
|
9a3fa7 |
1 file changed, 5 insertions(+)
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
diff --git a/iptables/iptables-xml.c b/iptables/iptables-xml.c
|
|
|
9a3fa7 |
index 49f8ea2826181..769f76550b764 100644
|
|
|
9a3fa7 |
--- a/iptables/iptables-xml.c
|
|
|
9a3fa7 |
+++ b/iptables/iptables-xml.c
|
|
|
9a3fa7 |
@@ -777,6 +777,11 @@ iptables_xml_main(int argc, char *argv[])
|
|
|
9a3fa7 |
for (a = 0; a < newargc; a++)
|
|
|
9a3fa7 |
DEBUGP("argv[%u]: %s\n", a, newargv[a]);
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
+ if (!chain) {
|
|
|
9a3fa7 |
+ fprintf(stderr, "%s: line %u failed - no chain found\n",
|
|
|
9a3fa7 |
+ prog_name, line);
|
|
|
9a3fa7 |
+ exit(1);
|
|
|
9a3fa7 |
+ }
|
|
|
9a3fa7 |
needChain(chain);// Should we explicitly look for -A
|
|
|
9a3fa7 |
do_rule(pcnt, bcnt, newargc, newargv, newargvattr);
|
|
|
9a3fa7 |
|
|
|
9a3fa7 |
--
|
|
|
9a3fa7 |
2.21.0
|
|
|
9a3fa7 |
|