minor bug in iptables 1.2.9

[Karsten Desler <kdesler@soohrt.org>]

[-- Attachment #1: Type: text/plain, Size: 534 bytes --]

Hi,

while reading the iptables 1.2.9 source, I found this small bug in
iptables.c line 276:

struct in_addr *
dotted_to_addr(const char *dotted)
{
	char buf[20];
	...

	/* copy dotted string, because we need to modify it */
	strncpy(buf, dotted, sizeof(buf) - 1);
	...

strncpy does not \0-terminate strings if strlen(src) == n, thus the
following loop can easily run over the end of buf, if a big enough
mask is given:
  iptables -A INPUT -p tcp -s 1.1.1.1/000000000000000000.

Attached is a patch to fix this problem.

    Karsten

[-- Attachment #2: iptables-1.2.9-overflow.patch --]
[-- Type: text/plain, Size: 311 bytes --]

--- iptables~.c	2004-01-30 09:34:29.000000000 +0100
+++ iptables.c	2004-01-30 09:35:14.000000000 +0100
@@ -274,6 +274,7 @@
 
 	/* copy dotted string, because we need to modify it */
 	strncpy(buf, dotted, sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = '\0';
 	addrp = (unsigned char *) &(addr.s_addr);
 
 	p = buf;