Re: minor bug in iptables 1.2.9

[Karsten Desler <kdesler@soohrt.org>]

[-- Attachment #1: Type: text/plain, Size: 262 bytes --]

Hi,

today I had a little more time to look at the code. A few lines
down, there's another incarnation of the same bug.
line 641:

	char buf[256];
	...
	strncpy(buf, name, sizeof(buf) - 1);
	if ((p = strrchr(buf, '/')) != NULL) {
	...

Patch attached.
  Karsten

[-- Attachment #2: iptables-1.2.9-overflow2.patch --]
[-- Type: text/plain, Size: 298 bytes --]

--- iptables~.c	2004-01-31 14:42:29.000000000 +0100
+++ iptables.c	2004-01-31 14:53:57.000000000 +0100
@@ -639,6 +640,7 @@
 	int i, j, k, n;
 
 	strncpy(buf, name, sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = '\0';
 	if ((p = strrchr(buf, '/')) != NULL) {
 		*p = '\0';
 		addrp = parse_mask(p + 1);