minor bug in iptables 1.2.9

minor bug in iptables 1.2.9

[Karsten Desler]

[-- Attachment #1: Type: text/plain, Size: 534 bytes --]

Hi,

while reading the iptables 1.2.9 source, I found this small bug in
iptables.c line 276:

struct in_addr *
dotted_to_addr(const char *dotted)
{
	char buf[20];
	...

	/* copy dotted string, because we need to modify it */
	strncpy(buf, dotted, sizeof(buf) - 1);
	...

strncpy does not \0-terminate strings if strlen(src) == n, thus the
following loop can easily run over the end of buf, if a big enough
mask is given:
  iptables -A INPUT -p tcp -s 1.1.1.1/000000000000000000.

Attached is a patch to fix this problem.

    Karsten

[-- Attachment #2: iptables-1.2.9-overflow.patch --]
[-- Type: text/plain, Size: 311 bytes --]

--- iptables~.c	2004-01-30 09:34:29.000000000 +0100
+++ iptables.c	2004-01-30 09:35:14.000000000 +0100
@@ -274,6 +274,7 @@
 
 	/* copy dotted string, because we need to modify it */
 	strncpy(buf, dotted, sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = '\0';
 	addrp = (unsigned char *) &(addr.s_addr);
 
 	p = buf;

Re: minor bug in iptables 1.2.9

[Martin Josefsson]

[-- Attachment #1: Type: text/plain, Size: 357 bytes --]

On Fri, 2004-01-30 at 09:48, Karsten Desler wrote:

> strncpy does not \0-terminate strings if strlen(src) == n, thus the
> following loop can easily run over the end of buf, if a big enough
> mask is given:
>   iptables -A INPUT -p tcp -s 1.1.1.1/000000000000000000.
> 
> Attached is a patch to fix this problem.

Applied, thanks

-- 
/Martin

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: minor bug in iptables 1.2.9

[Karsten Desler]

[-- Attachment #1: Type: text/plain, Size: 262 bytes --]

Hi,

today I had a little more time to look at the code. A few lines
down, there's another incarnation of the same bug.
line 641:

	char buf[256];
	...
	strncpy(buf, name, sizeof(buf) - 1);
	if ((p = strrchr(buf, '/')) != NULL) {
	...

Patch attached.
  Karsten

[-- Attachment #2: iptables-1.2.9-overflow2.patch --]
[-- Type: text/plain, Size: 298 bytes --]

--- iptables~.c	2004-01-31 14:42:29.000000000 +0100
+++ iptables.c	2004-01-31 14:53:57.000000000 +0100
@@ -639,6 +640,7 @@
 	int i, j, k, n;
 
 	strncpy(buf, name, sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = '\0';
 	if ((p = strrchr(buf, '/')) != NULL) {
 		*p = '\0';
 		addrp = parse_mask(p + 1);

Re: minor bug in iptables 1.2.9

[Martin Josefsson]

[-- Attachment #1: Type: text/plain, Size: 220 bytes --]

On Sat, 2004-01-31 at 14:56, Karsten Desler wrote:
> Hi,
> 
> today I had a little more time to look at the code. A few lines
> down, there's another incarnation of the same bug.

Thanks, applied.

-- 
/Martin

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: minor bug in iptables 1.2.9

[Martin Josefsson]

[-- Attachment #1: Type: text/plain, Size: 517 bytes --]

On Sat, 2004-01-31 at 15:29, Karsten Desler wrote:
> Hi,
> 
> And a couple more.
> 
> Attached are three patches.
> iptables.patch    - fixes for similar bugs in ip6tables,
>                     iptables- and ip6tables-restore
> extensions.patch  - fixes for similar bugs in the extensions/
>                     directory
> libiptc.patch     - simiar fix for libiptc

Applied slightly modified, you introduced some memory-corruption, arrays
start at 0...

Thanks for all these fixes.

-- 
/Martin

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]