|
 |
4cfa1d |
From d6087e02d9f25bba362db0af16355ee3be4e450a Mon Sep 17 00:00:00 2001
|
|
|
4cfa1d |
From: Phil Sutter <psutter@redhat.com>
|
|
|
4cfa1d |
Date: Tue, 21 Feb 2023 19:50:40 +0100
|
|
|
4cfa1d |
Subject: [PATCH] owner: Fix potential array out of bounds access
|
|
|
4cfa1d |
|
|
|
4cfa1d |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2160049
|
|
|
4cfa1d |
Upstream Status: nftables commit 9967911e3dabb
|
|
|
4cfa1d |
|
|
|
4cfa1d |
commit 9967911e3dabb32901617e81e56602af3b37287f
|
|
|
4cfa1d |
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
4cfa1d |
Date: Wed Dec 21 17:37:46 2022 +0100
|
|
|
4cfa1d |
|
|
|
4cfa1d |
owner: Fix potential array out of bounds access
|
|
|
4cfa1d |
|
|
|
4cfa1d |
If the link target length exceeds 'sizeof(tmp)' bytes, readlink() will
|
|
|
4cfa1d |
return 'sizeof(tmp)'. Using this value as index is illegal.
|
|
|
4cfa1d |
|
|
|
4cfa1d |
Original update from Phil, for the conntrack-tools tree, which also has
|
|
|
4cfa1d |
a copy of this function.
|
|
|
4cfa1d |
|
|
|
4cfa1d |
Fixes: 6d085b22a8b5 ("table: support for the table owner flag")
|
|
|
4cfa1d |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
4cfa1d |
|
|
|
4cfa1d |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
4cfa1d |
---
|
|
|
4cfa1d |
src/owner.c | 2 +-
|
|
|
4cfa1d |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
4cfa1d |
|
|
|
4cfa1d |
diff --git a/src/owner.c b/src/owner.c
|
|
|
4cfa1d |
index 2d98a2e..20bed38 100644
|
|
|
4cfa1d |
--- a/src/owner.c
|
|
|
4cfa1d |
+++ b/src/owner.c
|
|
|
4cfa1d |
@@ -66,7 +66,7 @@ static char *portid2name(pid_t pid, uint32_t portid, unsigned long inode)
|
|
|
4cfa1d |
continue;
|
|
|
4cfa1d |
|
|
|
4cfa1d |
rl = readlink(procname, tmp, sizeof(tmp));
|
|
|
4cfa1d |
- if (rl <= 0 || rl > (ssize_t)sizeof(tmp))
|
|
|
4cfa1d |
+ if (rl <= 0 || rl >= (ssize_t)sizeof(tmp))
|
|
|
4cfa1d |
continue;
|
|
|
4cfa1d |
|
|
|
4cfa1d |
tmp[rl] = 0;
|
|
|
4cfa1d |
--
|
|
|
4cfa1d |
2.39.2
|
|
|
4cfa1d |
|