diff mbox

: libnetfilter_log: Uninitialized values in libnetfilter_log.c

Message ID CA+J3vc+YmPjtr2sJqR39cQSLOO+xmVK=RLChSRgv_+LN2tuRsQ@mail.gmail.com
State Changes Requested
Headers show

Commit Message

Ivan Homoliak Jan. 31, 2014, 10:39 a.m. UTC 
Unitialized values in libnetfilter.log.c which were discovered by
valgrind and ulogd.

Signed-off-by: Ivan Homoliak <xhomol11@gmail.com>
---

Valgrinds output:

==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==13821==    at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
==13821==    by 0x5433E81: nfnl_send (libnfnetlink.c:391)
==13821==    by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
==13821==    by 0x522E4E6: __build_send_cfg_msg (libnetfilter_log.c:143)
==13821==    by 0x522E87E: nflog_bind_group (libnetfilter_log.c:413)
==13821==    by 0x5029F3B: start (ulogd_inppkt_NFLOG.c:573)
==13821==    by 0x403E5D: create_stack_start_instances (ulogd.c:918)
==13821==    by 0x4041B4: create_stack (ulogd.c:1010)
==13821==    by 0x4078D6: config_parse_file (conffile.c:225)
==13821==    by 0x404411: parse_conffile (ulogd.c:1088)
==13821==    by 0x405478: main (ulogd.c:1573)
==13821==  Address 0x7feffff69 is on thread 1's stack
==13821==  Uninitialised value was created by a stack allocation
==13821==    at 0x522E45B: __build_send_cfg_msg (libnetfilter_log.c:129)
==13821==
==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==13821==    at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
==13821==    by 0x5433E81: nfnl_send (libnfnetlink.c:391)
==13821==    by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
==13821==    by 0x522E9A0: nflog_set_mode (libnetfilter_log.c:481)
==13821==    by 0x5029FA2: start (ulogd_inppkt_NFLOG.c:581)
==13821==    by 0x403E5D: create_stack_start_instances (ulogd.c:918)
==13821==    by 0x4041B4: create_stack (ulogd.c:1010)
==13821==    by 0x4078D6: config_parse_file (conffile.c:225)
==13821==    by 0x404411: parse_conffile (ulogd.c:1088)
==13821==    by 0x405478: main (ulogd.c:1573)
==13821==  Address 0x7feffff9d is on thread 1's stack
==13821==  Uninitialised value was created by a stack allocation
==13821==    at 0x50293D0: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so)


Version: libnetfilter_log-1.0.1
File: libnetfilter_log.c
GCC: 4.8.2 20131212 (Red Hat 4.8.2-7)
OS: Fedora release 19 (Schrödinger's Cat)
Kernel: 3.12.5-200.fc19.x86_64

Comments

Pablo Neira Ayuso Jan. 31, 2014, 11:12 a.m. UTC | #1 
On Fri, Jan 31, 2014 at 11:39:09AM +0100, Ivan Homoliak wrote:
> Unitialized values in libnetfilter.log.c which were discovered by
> valgrind and ulogd.
> 
> Signed-off-by: Ivan Homoliak <xhomol11@gmail.com>
> ---
> 
> Valgrinds output:
> 
> ==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
> ==13821==    at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
> ==13821==    by 0x5433E81: nfnl_send (libnfnetlink.c:391)
> ==13821==    by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
> ==13821==    by 0x522E4E6: __build_send_cfg_msg (libnetfilter_log.c:143)
> ==13821==    by 0x522E87E: nflog_bind_group (libnetfilter_log.c:413)
> ==13821==    by 0x5029F3B: start (ulogd_inppkt_NFLOG.c:573)
> ==13821==    by 0x403E5D: create_stack_start_instances (ulogd.c:918)
> ==13821==    by 0x4041B4: create_stack (ulogd.c:1010)
> ==13821==    by 0x4078D6: config_parse_file (conffile.c:225)
> ==13821==    by 0x404411: parse_conffile (ulogd.c:1088)
> ==13821==    by 0x405478: main (ulogd.c:1573)
> ==13821==  Address 0x7feffff69 is on thread 1's stack
> ==13821==  Uninitialised value was created by a stack allocation
> ==13821==    at 0x522E45B: __build_send_cfg_msg (libnetfilter_log.c:129)
> ==13821==
> ==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
> ==13821==    at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
> ==13821==    by 0x5433E81: nfnl_send (libnfnetlink.c:391)
> ==13821==    by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
> ==13821==    by 0x522E9A0: nflog_set_mode (libnetfilter_log.c:481)
> ==13821==    by 0x5029FA2: start (ulogd_inppkt_NFLOG.c:581)
> ==13821==    by 0x403E5D: create_stack_start_instances (ulogd.c:918)
> ==13821==    by 0x4041B4: create_stack (ulogd.c:1010)
> ==13821==    by 0x4078D6: config_parse_file (conffile.c:225)
> ==13821==    by 0x404411: parse_conffile (ulogd.c:1088)
> ==13821==    by 0x405478: main (ulogd.c:1573)
> ==13821==  Address 0x7feffff9d is on thread 1's stack
> ==13821==  Uninitialised value was created by a stack allocation
> ==13821==    at 0x50293D0: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so)
> 
> 
> Version: libnetfilter_log-1.0.1
> File: libnetfilter_log.c
> GCC: 4.8.2 20131212 (Red Hat 4.8.2-7)
> OS: Fedora release 19 (Schrödinger's Cat)
> Kernel: 3.12.5-200.fc19.x86_64

> --- ./src/libnetfilter_log.c	2010-11-04 00:19:45.000000000 +0100
> +++ ../../libnetfilter_log-1.0.1/src/libnetfilter_log.c	2014-01-03 10:48:34.592783388 +0100
> @@ -133,6 +133,8 @@ __build_send_cfg_msg(struct nflog_handle
>  		struct nlmsghdr nmh;
>  	} u;
>  	struct nfulnl_msg_config_cmd cmd;
> +        
> +        memset(&u, 0, sizeof(u)); //ihomoliak	        

Could you remove the comment on the right side?

While at it, please, don't convert tabs to spaces.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

--- ./src/libnetfilter_log.c	2010-11-04 00:19:45.000000000 +0100
+++ ../../libnetfilter_log-1.0.1/src/libnetfilter_log.c	2014-01-03 10:48:34.592783388 +0100
@@ -133,6 +133,8 @@  __build_send_cfg_msg(struct nflog_handle
 		struct nlmsghdr nmh;
 	} u;
 	struct nfulnl_msg_config_cmd cmd;
+        
+        memset(&u, 0, sizeof(u)); //ihomoliak	        
 
 	nfnl_fill_hdr(h->nfnlssh, &u.nmh, 0, pf, groupnum,
 		      NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
@@ -469,12 +471,14 @@  int nflog_set_mode(struct nflog_g_handle
 		struct nlmsghdr nmh;
 	} u;
 	struct nfulnl_msg_config_mode params;
-
+        memset(&u, 0, sizeof(u)); //ihomoliak	
+        
 	nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
 		      NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
 
 	params.copy_range = htonl(range);	/* copy_range is short */
 	params.copy_mode = mode;
+        params._pad = (u_int8_t) 0;
 	nfnl_addattr_l(&u.nmh, sizeof(u), NFULA_CFG_MODE, &params,
 		       sizeof(params));
 
@@ -500,6 +504,8 @@  int nflog_set_timeout(struct nflog_g_han
 		struct nlmsghdr nmh;
 	} u;
 
+        memset(&u, 0, sizeof(u)); //ihomoliak	
+        
 	nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
 		      NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
 
@@ -525,6 +531,8 @@  int nflog_set_qthresh(struct nflog_g_han
 		struct nlmsghdr nmh;
 	} u;
 
+        memset(&u, 0, sizeof(u)); //ihomoliak
+        
 	nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
 		      NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
 
@@ -553,8 +561,10 @@  int nflog_set_nlbufsiz(struct nflog_g_ha
 		char buf[NFNL_HEADER_LEN+NFA_LENGTH(sizeof(u_int32_t))];
 		struct nlmsghdr nmh;
 	} u;
-	int status;
+	int status = 0; //ihomoliak
 
+        memset(&u, 0, sizeof(u)); //ihomoliak	
+        
 	nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
 		      NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
 
@@ -588,6 +598,8 @@  int nflog_set_flags(struct nflog_g_handl
 		struct nlmsghdr nmh;
 	} u;
 
+        memset(&u, 0, sizeof(u)); //ihomoliak
+	
 	nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
 		      NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);