|
 |
bacbc8 |
From 2b491f62a6a2d34f747ccf083eb016a8d0dcdba9 Mon Sep 17 00:00:00 2001
|
|
|
bacbc8 |
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
bacbc8 |
Date: Mon, 10 Jun 2019 13:12:20 +0200
|
|
|
bacbc8 |
Subject: [PATCH] src: invalid read when importing chain name
|
|
|
bacbc8 |
|
|
|
bacbc8 |
Use strlen(), otherwise mpz_import_data() reads too much beyond the real
|
|
|
bacbc8 |
chain string. Valgrind reports the following error:
|
|
|
bacbc8 |
|
|
|
bacbc8 |
==2759== Invalid read of size 1
|
|
|
bacbc8 |
==2759== at 0x67D68D6: __gmpz_import (in /usr/lib/x86_64-linux-gnu/libgmp.so.10.3.2)
|
|
|
bacbc8 |
==2759== by 0x4E79467: mpz_import_data (gmputil.c:133)
|
|
|
bacbc8 |
==2759== by 0x4E60A12: constant_expr_alloc (expression.c:375)
|
|
|
bacbc8 |
==2759== by 0x4E8ED65: nft_parse (parser_bison.y:3825)
|
|
|
bacbc8 |
==2759== by 0x4E7E850: nft_parse_bison_buffer (libnftables.c:357)
|
|
|
bacbc8 |
==2759== by 0x4E7E850: nft_run_cmd_from_buffer (libnftables.c:424)
|
|
|
bacbc8 |
==2759== by 0x1095D4: main (in /tmp/a.out)
|
|
|
bacbc8 |
==2759== Address 0x6ee1b4a is 0 bytes after a block of size 10 alloc'd
|
|
|
bacbc8 |
==2759== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
|
|
|
bacbc8 |
==2759== by 0x59FD3B9: strdup (strdup.c:42)
|
|
|
bacbc8 |
==2759== by 0x4E7963D: xstrdup (utils.c:75)
|
|
|
bacbc8 |
==2759== by 0x4E9C233: nft_lex (scanner.l:626)
|
|
|
bacbc8 |
==2759== by 0x4E8E382: nft_parse (parser_bison.c:5297)
|
|
|
bacbc8 |
==2759== by 0x4E7E850: nft_parse_bison_buffer (libnftables.c:357)
|
|
|
bacbc8 |
==2759== by 0x4E7E850: nft_run_cmd_from_buffer (libnftables.c:424)
|
|
|
bacbc8 |
|
|
|
bacbc8 |
Fixes: f1e8a129ee42 ("src: Introduce chain_expr in jump and goto statements")
|
|
|
bacbc8 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
bacbc8 |
(cherry picked from commit 142350f154c78a1aeccebc6115440162986dc906)
|
|
|
bacbc8 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
bacbc8 |
---
|
|
|
bacbc8 |
src/netlink.c | 4 ++--
|
|
|
bacbc8 |
src/parser_bison.y | 4 ++--
|
|
|
bacbc8 |
2 files changed, 4 insertions(+), 4 deletions(-)
|
|
|
bacbc8 |
|
|
|
bacbc8 |
diff --git a/src/netlink.c b/src/netlink.c
|
|
|
bacbc8 |
index fcd05b73f4c0e..fc310fd293d64 100644
|
|
|
bacbc8 |
--- a/src/netlink.c
|
|
|
bacbc8 |
+++ b/src/netlink.c
|
|
|
bacbc8 |
@@ -438,8 +438,8 @@ static struct expr *netlink_alloc_verdict(const struct location *loc,
|
|
|
bacbc8 |
case NFT_GOTO:
|
|
|
bacbc8 |
chain = constant_expr_alloc(loc, &string_type,
|
|
|
bacbc8 |
BYTEORDER_HOST_ENDIAN,
|
|
|
bacbc8 |
- NFT_CHAIN_MAXNAMELEN *
|
|
|
bacbc8 |
- BITS_PER_BYTE, nld->chain);
|
|
|
bacbc8 |
+ strlen(nld->chain) * BITS_PER_BYTE,
|
|
|
bacbc8 |
+ nld->chain);
|
|
|
bacbc8 |
break;
|
|
|
bacbc8 |
default:
|
|
|
bacbc8 |
chain = NULL;
|
|
|
bacbc8 |
diff --git a/src/parser_bison.y b/src/parser_bison.y
|
|
|
bacbc8 |
index 2e8ebde34eee6..4bd1ae1e39855 100644
|
|
|
bacbc8 |
--- a/src/parser_bison.y
|
|
|
bacbc8 |
+++ b/src/parser_bison.y
|
|
|
bacbc8 |
@@ -3480,8 +3480,8 @@ chain_expr : variable_expr
|
|
|
bacbc8 |
{
|
|
|
bacbc8 |
$$ = constant_expr_alloc(&@$, &string_type,
|
|
|
bacbc8 |
BYTEORDER_HOST_ENDIAN,
|
|
|
bacbc8 |
- NFT_CHAIN_MAXNAMELEN *
|
|
|
bacbc8 |
- BITS_PER_BYTE, $1);
|
|
|
bacbc8 |
+ strlen($1) * BITS_PER_BYTE,
|
|
|
bacbc8 |
+ $1);
|
|
|
bacbc8 |
}
|
|
|
bacbc8 |
;
|
|
|
bacbc8 |
|
|
|
bacbc8 |
--
|
|
|
bacbc8 |
2.21.0
|
|
|
bacbc8 |
|