| Message ID | 20240409113101.672-1-phil@nwl.cc |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [iptables] xshared: Fix parsing of empty string arg in '-c' option | expand |
On Tue, Apr 09, 2024 at 01:31:01PM +0200, Phil Sutter wrote: > Calling iptables with '-c ""' resulted in a call to strchr() with an > invalid pointer as 'optarg + 1' points to past the buffer. The most > simple fix is to drop the offset: The global optstring part specifies a > single colon after 'c', so getopt() enforces a valid pointer in optarg. > If it contains a comma at first position, packet counter value parsing > will fail so all cases are covered. > > Reported-by: gorbanev.es@gmail.com > Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 > Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") > Signed-off-by: Phil Sutter <phil@nwl.cc> Patch applied.
diff --git a/extensions/iptables.t b/extensions/iptables.t index b4b6d677abab1..5d6d3d15cc5fd 100644 --- a/extensions/iptables.t +++ b/extensions/iptables.t @@ -4,3 +4,8 @@ -i eth+ -o alongifacename+;=;OK ! -i eth0;=;OK ! -o eth+;=;OK +-c "";;FAIL +-c ,3;;FAIL +-c 3,;;FAIL +-c ,;;FAIL +-c 2,3 -j ACCEPT;-j ACCEPT;OK diff --git a/iptables/xshared.c b/iptables/xshared.c index b998dd75aaf05..b1997ea35f8f8 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -1885,7 +1885,7 @@ void do_parse(int argc, char *argv[], set_option(p->ops, &cs->options, OPT_COUNTERS, &args->invflags, invert); args->pcnt = optarg; - args->bcnt = strchr(args->pcnt + 1, ','); + args->bcnt = strchr(args->pcnt, ','); if (args->bcnt) args->bcnt++; if (!args->bcnt && xs_has_arg(argc, argv))
Calling iptables with '-c ""' resulted in a call to strchr() with an invalid pointer as 'optarg + 1' points to past the buffer. The most simple fix is to drop the offset: The global optstring part specifies a single colon after 'c', so getopt() enforces a valid pointer in optarg. If it contains a comma at first position, packet counter value parsing will fail so all cases are covered. Reported-by: gorbanev.es@gmail.com Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") Signed-off-by: Phil Sutter <phil@nwl.cc> --- extensions/iptables.t | 5 +++++ iptables/xshared.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)