From patchwork Tue Nov 26 12:15:13 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 294313 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 543452C00A3 for ; Tue, 26 Nov 2013 23:15:27 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755956Ab3KZMPY (ORCPT ); Tue, 26 Nov 2013 07:15:24 -0500 Received: from mail.us.es ([193.147.175.20]:36082 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755276Ab3KZMPX (ORCPT ); Tue, 26 Nov 2013 07:15:23 -0500 Received: (qmail 12087 invoked from network); 26 Nov 2013 13:15:20 +0100 Received: from unknown (HELO us.es) (192.168.2.12) by us.es with SMTP; 26 Nov 2013 13:15:20 +0100 Received: (qmail 947 invoked by uid 507); 26 Nov 2013 12:15:20 -0000 X-Qmail-Scanner-Diagnostics: from 127.0.0.1 by antivirus2 (envelope-from , uid 501) with qmail-scanner-2.10 (clamdscan: 0.98/18162. spamassassin: 3.3.2. Clear:RC:1(127.0.0.1):SA:0(-99.8/7.5):. Processed in 1.803272 secs); 26 Nov 2013 12:15:20 -0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on antivirus2 X-Spam-Level: X-Spam-Status: No, score=-99.8 required=7.5 tests=BAYES_50,RCVD_IN_PBL, RCVD_IN_RP_RNBL, RCVD_IN_SORBS_DUL, RDNS_DYNAMIC, SMTPAUTH_US, USER_IN_WHITELIST autolearn=disabled version=3.3.2 X-Spam-ASN: AS12715 188.78.0.0/16 X-Envelope-From: pablo@netfilter.org Received: from unknown (HELO antivirus2) (127.0.0.1) by us.es with SMTP; 26 Nov 2013 12:15:18 -0000 Received: from 192.168.1.13 (192.168.1.13) by antivirus2 (F-Secure/fsigk_smtp/412/antivirus2); Tue, 26 Nov 2013 13:15:18 +0100 (CET) X-Virus-Status: clean(F-Secure/fsigk_smtp/412/antivirus2) Received: (qmail 13523 invoked from network); 26 Nov 2013 13:15:18 +0100 Received: from 245.227.78.188.dynamic.jazztel.es (HELO localhost.localdomain) (pneira@us.es@188.78.227.245) by mail.us.es with SMTP; 26 Nov 2013 13:15:18 +0100 From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: anarey@gmail.com Subject: [PATCH iptables-nftables] nft: fix out of bound memory copy Date: Tue, 26 Nov 2013 13:15:13 +0100 Message-Id: <1385468113-4620-1-git-send-email-pablo@netfilter.org> X-Mailer: git-send-email 1.7.10.4 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Valgrind reports an invalid read after a memory block: ==11114== Invalid read of size 8 ==11114== at 0x4C2DB02: memcpy@@GLIBC_2.14 (mc_replace_strmem.c:877) ==11114== by 0x41788E: add_match (nft.c:781) ==11114== by 0x41B54C: nft_ipv4_add (nft-ipv4.c:72) ==11114== by 0x415DF2: nft_rule_new.isra.2 (nft.c:945) ==11114== by 0x418ACE: nft_rule_append (nft.c:1000) ==11114== by 0x413A92: add_entry.isra.6 (xtables.c:424) ==11114== by 0x4152DE: do_commandx (xtables.c:1184) ==11114== by 0x4134E8: xtables_main (xtables-standalone.c:72) ==11114== by 0x5B87994: (below main) (libc-start.c:260) ==11114== Address 0x61399e8 is 8 bytes after a block of size 48 alloc'd ==11114== at 0x4C2B514: calloc (vg_replace_malloc.c:593) ==11114== by 0x52448C8: xtables_calloc (xtables.c:272) ==11114== by 0x410AC2: command_default (xshared.c:150) ==11114== by 0x4149A2: do_commandx (xtables.c:1075) ==11114== by 0x4134E8: xtables_main (xtables-standalone.c:72) ==11114== by 0x5B87994: (below main) (libc-start.c:260) m->u.match_size also contains the size of the xt_entry_match structure. Fix also the target path which is very similar. Reported-by: Ana Rey Botello Tested-by: Ana Rey Botello Signed-off-by: Pablo Neira Ayuso --- iptables/nft.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/iptables/nft.c b/iptables/nft.c index 01e0264..2135b04 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -776,7 +776,7 @@ static int __add_match(struct nft_rule_expr *e, struct xt_entry_match *m) if (info == NULL) return -ENOMEM; - memcpy(info, m->data, m->u.match_size); + memcpy(info, m->data, m->u.match_size - sizeof(*m)); nft_rule_expr_set(e, NFT_EXPR_MT_INFO, info, m->u.match_size - sizeof(*m)); return 0; @@ -799,20 +799,17 @@ int add_match(struct nft_rule *r, struct xt_entry_match *m) static int __add_target(struct nft_rule_expr *e, struct xt_entry_target *t) { - void *info = NULL; + void *info; nft_rule_expr_set(e, NFT_EXPR_TG_NAME, t->u.user.name, strlen(t->u.user.name)); nft_rule_expr_set_u32(e, NFT_EXPR_TG_REV, t->u.user.revision); - if (info == NULL) { - info = calloc(1, t->u.target_size); - if (info == NULL) - return -ENOMEM; - - memcpy(info, t->data, t->u.target_size); - } + info = calloc(1, t->u.target_size); + if (info == NULL) + return -ENOMEM; + memcpy(info, t->data, t->u.target_size - sizeof(*t)); nft_rule_expr_set(e, NFT_EXPR_TG_INFO, info, t->u.target_size - sizeof(*t)); return 0;