#263154: iptables: segfault with multiple ip hostnames

#263154: iptables: segfault with multiple ip hostnames

[Laurence J. Lane]

http://bugs.debian.org/263154

iptables 1.2.11 segfaults when given a domain name that resolves 
to multiple ip addresses. The situation is the same for kernel 
versions 2.4.26 and 2.6.7.

As an example:

  # iptables -I INPUT -s google.com -j DROP
  free(): invalid pointer 0x8055a4c!
  Segmentation fault

Re: #263154: iptables: segfault with multiple ip hostnames

[Phil Oester]

On Tue, Aug 03, 2004 at 06:03:50PM -0400, Laurence J. Lane wrote:
> http://bugs.debian.org/263154
> 
> iptables 1.2.11 segfaults when given a domain name that resolves 
> to multiple ip addresses. The situation is the same for kernel 
> versions 2.4.26 and 2.6.7.

This is fixed in CVS.  Patch below for reference.

Phil


diff -u -r1.68 -r1.69
--- iptables/iptables.c	2004/05/26 16:04:48	1.68
+++ iptables/iptables.c	2004/07/04 15:20:53	1.69
@@ -2339,11 +2339,8 @@
 		e = NULL;
 	}
 
-	for (c = 0; c < nsaddrs; c++)
-		free(&saddrs[c]);
-
-	for (c = 0; c < ndaddrs; c++)
-		free(&daddrs[c]);
+	free(saddrs);
+	free(daddrs);
 
 	if (opts != original_opts) {
 		free(opts);

Re: #263154: iptables: segfault with multiple ip hostnames

[Patrick McHardy]

Laurence J. Lane wrote:

>http://bugs.debian.org/263154
>
>iptables 1.2.11 segfaults when given a domain name that resolves 
>to multiple ip addresses. The situation is the same for kernel 
>versions 2.4.26 and 2.6.7.
>
>As an example:
>
>  # iptables -I INPUT -s google.com -j DROP
>  free(): invalid pointer 0x8055a4c!
>  Segmentation fault
>  
>
Already fixed in CVS:

http://cvs.netfilter.org/iptables/iptables.c?r1=1.68&r2=1.69

But seems to be missing this:

diff -u -r1.69 iptables.c
--- iptables.c  4 Jul 2004 15:20:53 -0000       1.69
+++ iptables.c  3 Aug 2004 22:22:25 -0000
@@ -551,7 +551,7 @@
                                                                                                                              

                while (host->h_addr_list[*naddr] != (char *) NULL)
                        (*naddr)++;
-               addr = fw_calloc(*naddr, sizeof(struct in_addr));
+               addr = fw_calloc(*naddr, sizeof(struct in_addr) * *naddr);
                for (i = 0; i < *naddr; i++)
                        inaddrcpy(&(addr[i]),
                                  (struct in_addr *) host->h_addr_list[i]);

Regards
Patrick

Re: #263154: iptables: segfault with multiple ip hostnames

[Herve Eychenne]

On Wed, Aug 04, 2004 at 12:26:22AM +0200, Patrick McHardy wrote:

> Laurence J. Lane wrote:

> >http://bugs.debian.org/263154
> >
> >iptables 1.2.11 segfaults when given a domain name that resolves 
> >to multiple ip addresses. The situation is the same for kernel 
> >versions 2.4.26 and 2.6.7.
> >
> >As an example:
> >
> > # iptables -I INPUT -s google.com -j DROP
> > free(): invalid pointer 0x8055a4c!
> > Segmentation fault
> > 
> >
> Already fixed in CVS:

> http://cvs.netfilter.org/iptables/iptables.c?r1=1.68&r2=1.69

Does this change make sense for ip6tables as well? If so, were the
equivalent changes committed as well?

 Herve

-- 
 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/