Buffer of by one in iptables.c in iptables v1.2.7a

Buffer of by one in iptables.c in iptables v1.2.7a

[Arvanitis Kostas]

The line in find_target() that reads:

char path[sizeof(IPT_LIB_DIR) + sizeof("/libipt_.so") + strlen(name)]

is used as the target buffer for a sprintf() statement. However sprintf will 
also append a '\0' after the string, so the corrected line should be:

char path[sizeof(IPT_LIB_DIR) + sizeof("/libipt_.so") + strlen(name)+1]

This does not seem to affect the program, since path[] is allocated on the 
stack and there is nothing following it. However, for the shake of 
completeness, I think it should be corrected.

PS: Keep up the good work.
PS2: Is there a thought for iptables to take src/dst addresses as ranges in 
the form of ip_low - ip_high? (so as to be more compatible with the NAT-MIB)
-- 
A: No. See http://www.netmeister.org/news/learn2quote.html
Q: Should I include quotations after my reply ?

Re: Buffer of by one in iptables.c in iptables v1.2.7a

[Patrick Schaaf]

On Fri, Feb 21, 2003 at 04:24:05PM +0200, Arvanitis Kostas wrote:
> The line in find_target() that reads:
> 
> char path[sizeof(IPT_LIB_DIR) + sizeof("/libipt_.so") + strlen(name)]
> 
> is used as the target buffer for a sprintf() statement.

That is probably correct, although a bit subtle.

You did not show the format string used later, and I'm too lazy do
dig for the source, but I guess it will be something like

	sprintf(path, IPT_LIB_DIR "/libipt_%s.so", name);

Right?

Now, count the characters again, with an eye not on the path[sizeof]
stuff, but on the actual format string. Note how the value of 'name'
will be embedded in the formatted string: it does not need a '\0' in
that representation.

Also note that the two sizeofs each contribute one '\0' (their args
being constant C strings), but only one of them is needed for
sprintf() to properly terminate the result. So, if I don't
miscount, there's even one surplus byte in path[].

This should fix that:

	char path[sizeof(IPT_LIB_DIR "/libipt_.so") + strlen(name)]

best regards
  Patrick