Message ID | 20171113132754.14911-1-nicolas.dichtel@6wind.com |
---|---|
State | Accepted |
Delegated to: | Pablo Neira |
Headers | show |
Series | [iptables,v2] libxt_sctp: fix array out of range in print_chunk | expand |
On Mon, Nov 13, 2017 at 02:27:54PM +0100, Nicolas Dichtel wrote: > From: huaibin Wang <huaibin.wang@6wind.com> > > For chunk type ASCONF, ASCONF_ACK and FORWARD_TSN, sctp_chunk_names[].chunk_type > is not equal to the corresponding index in sctp_chunk_names[]. Using this field > leads to a segmentation fault (index out of range). > > Example > $ iptables -A INPUT -p sctp --chunk-type all ASCONF,ASCONF_ACK,FORWARD_TSN -j ACCEPT > $ iptables -L > Chain INPUT (policy ACCEPT) > target prot opt source destination > Segmentation fault Applied, thanks a lot Nicolas. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c index df1936be8b83..140de2653b1e 100644 --- a/extensions/libxt_sctp.c +++ b/extensions/libxt_sctp.c @@ -370,7 +370,7 @@ print_chunk(uint32_t chunknum, int numeric) for (i = 0; i < ARRAY_SIZE(sctp_chunk_names); ++i) if (sctp_chunk_names[i].chunk_type == chunknum) - printf("%s", sctp_chunk_names[chunknum].name); + printf("%s", sctp_chunk_names[i].name); } } diff --git a/extensions/libxt_sctp.t b/extensions/libxt_sctp.t index 2f75e2a68e8e..4016e4fb1880 100644 --- a/extensions/libxt_sctp.t +++ b/extensions/libxt_sctp.t @@ -23,10 +23,7 @@ -p sctp -m sctp --chunk-types all COOKIE_ACK;=;OK -p sctp -m sctp --chunk-types all ECN_ECNE;=;OK -p sctp -m sctp --chunk-types all ECN_CWR;=;OK -# ERROR: iptables-save segfaults: iptables -A INPUT -p sctp -m sctp --chunk-types all ASCONF -# -p sctp -m sctp --chunk-types all ASCONF;=;OK -# ERROR: iptables-save segfaults: iptables -A INPUT -p sctp -m sctp --chunk-types all ASCONF_ACK -# -p sctp -m sctp --chunk-types all ASCONF_ACK;=;OK -# ERROR: iptables-save segfaults: iptables -A INPUT -p sctp -m sctp --chunk-types all FORWARD_TSN -# -p sctp -m sctp --chunk-types all FORWARD_TSN;=;OK +-p sctp -m sctp --chunk-types all ASCONF;=;OK +-p sctp -m sctp --chunk-types all ASCONF_ACK;=;OK +-p sctp -m sctp --chunk-types all FORWARD_TSN;=;OK -p sctp -m sctp --chunk-types all SHUTDOWN_COMPLETE;=;OK