diff mbox

[ulogd2] ulogd: fix crash when ipv4 packet is truncated

Message ID 1476195747-2852-1-git-send-email-zlpnobody@163.com
State Accepted
Delegated to: Pablo Neira
Headers show

Commit Message

Liping Zhang Oct. 11, 2016, 2:22 p.m. UTC 
From: Liping Zhang <liping.zhang@spreadtrum.com>

If ipv4 packet is truncated, we should not try to dereference the
iph pointer. Otherwise, if the user add such iptables rules
"-j NFLOG --nflog-size 0", we will dereference the NULL pointer
and crash may happen.

Reported-by: Chris Caputo <ccaputo@alt.net>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
---
 Sorry to redeliver this patch, my mail server told me that it failed.

 filter/raw2packet/ulogd_raw2packet_BASE.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Pablo Neira Ayuso Oct. 17, 2016, 3:34 p.m. UTC | #1 
On Tue, Oct 11, 2016 at 10:22:27PM +0800, Liping Zhang wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> If ipv4 packet is truncated, we should not try to dereference the
> iph pointer. Otherwise, if the user add such iptables rules
> "-j NFLOG --nflog-size 0", we will dereference the NULL pointer
> and crash may happen.

With Eric's permission, I'm applying this. Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/filter/raw2packet/ulogd_raw2packet_BASE.c b/filter/raw2packet/ulogd_raw2packet_BASE.c
index 8a6180c..fd2665a 100644
--- a/filter/raw2packet/ulogd_raw2packet_BASE.c
+++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
@@ -717,7 +717,7 @@  static int _interp_iphdr(struct ulogd_pluginstance *pi, uint32_t len)
 	struct ulogd_key *ret = pi->output.keys;
 	struct iphdr *iph =
 		ikey_get_ptr(&pi->input.keys[INKEY_RAW_PCKT]);
-	void *nexthdr = (uint32_t *)iph + iph->ihl;
+	void *nexthdr;
 
 	if (len < sizeof(struct iphdr) || len <= (uint32_t)(iph->ihl * 4))
 		return ULOGD_IRET_OK;
@@ -734,6 +734,7 @@  static int _interp_iphdr(struct ulogd_pluginstance *pi, uint32_t len)
 	okey_set_u16(&ret[KEY_IP_ID], ntohs(iph->id));
 	okey_set_u16(&ret[KEY_IP_FRAGOFF], ntohs(iph->frag_off));
 
+	nexthdr = (uint32_t *)iph + iph->ihl;
 	switch (iph->protocol) {
 	case IPPROTO_TCP:
 		_interp_tcp(pi, nexthdr, len);