* [libnftnl PATCH] target: Fix an invalid read.
@ 2014-04-13 18:08 Ana Rey
2014-04-13 18:08 ` [libnftnl PATCH] tests: Fix a memory leak Ana Rey
2014-04-13 18:21 ` [libnftnl PATCH] target: Fix an invalid read Florian Westphal
0 siblings, 2 replies; 4+ messages in thread
From: Ana Rey @ 2014-04-13 18:08 UTC (permalink / raw)
To: netfilter-devel; +Cc: Ana Rey
Valgrind reports the following invalid read:
$ sudo valgrind --leak-check=full ./nft-parsing-test -f ../jsonfiles/35-rule-target.json
==26018== Invalid read of size 8
==26018== at 0x4E484E3: nft_rule_expr_target_set (target.c:46)
==26018== by 0x4E40B54: nft_rule_expr_set (expr.c:73)
==26018== by 0x4E48167: nft_rule_expr_target_json_parse (target.c:185)
==26018== by 0x4E4091D: nft_jansson_expr_parse (jansson.c:206)
==26018== by 0x4E3B769: nft_jansson_parse_rule (rule.c:606)
==26018== by 0x4E3F055: nft_ruleset_do_parse (ruleset.c:312)
==26018== by 0x401479: test_json (nft-parsing-test.c:129)
==26018== by 0x4017C2: execute_test_file (nft-parsing-test.c:270)
==26018== by 0x400EBB: main (nft-parsing-test.c:332)
==26018== Address 0x5c34a60 is 0 bytes inside a block of size 4 alloc'd
==26018== at 0x4C274A0: malloc (vg_replace_malloc.c:291)
==26018== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018==
==26018== Invalid read of size 8
==26018== at 0x4E484ED: nft_rule_expr_target_set (target.c:46)
==26018== by 0x4E40B54: nft_rule_expr_set (expr.c:73)
==26018== by 0x4E48167: nft_rule_expr_target_json_parse (target.c:185)
==26018== by 0x4E4091D: nft_jansson_expr_parse (jansson.c:206)
==26018== by 0x4E3B769: nft_jansson_parse_rule (rule.c:606)
==26018== by 0x4E3F055: nft_ruleset_do_parse (ruleset.c:312)
==26018== by 0x401479: test_json (nft-parsing-test.c:129)
==26018== by 0x4017C2: execute_test_file (nft-parsing-test.c:270)
==26018== by 0x400EBB: main (nft-parsing-test.c:332)
==26018== Address 0x5c34a68 is 4 bytes after a block of size 4 alloc'd
==26018== at 0x4C274A0: malloc (vg_replace_malloc.c:291)
==26018== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018==
==26018== Invalid read of size 8
==26018== at 0x4E484F5: nft_rule_expr_target_set (target.c:46)
==26018== by 0x4E40B54: nft_rule_expr_set (expr.c:73)
==26018== by 0x4E48167: nft_rule_expr_target_json_parse (target.c:185)
==26018== by 0x4E4091D: nft_jansson_expr_parse (jansson.c:206)
==26018== by 0x4E3B769: nft_jansson_parse_rule (rule.c:606)
==26018== by 0x4E3F055: nft_ruleset_do_parse (ruleset.c:312)
==26018== by 0x401479: test_json (nft-parsing-test.c:129)
==26018== by 0x4017C2: execute_test_file (nft-parsing-test.c:270)
==26018== by 0x400EBB: main (nft-parsing-test.c:332)
==26018== Address 0x5c34a70 is 12 bytes after a block of size 4 alloc'd
==26018== at 0x4C274A0: malloc (vg_replace_malloc.c:291)
==26018== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018==
==26018== Invalid read of size 4
==26018== at 0x4E484FD: nft_rule_expr_target_set (target.c:46)
==26018== by 0x4E40B54: nft_rule_expr_set (expr.c:73)
==26018== by 0x4E48167: nft_rule_expr_target_json_parse (target.c:185)
==26018== by 0x4E4091D: nft_jansson_expr_parse (jansson.c:206)
==26018== by 0x4E3B769: nft_jansson_parse_rule (rule.c:606)
==26018== by 0x4E3F055: nft_ruleset_do_parse (ruleset.c:312)
==26018== by 0x401479: test_json (nft-parsing-test.c:129)
==26018== by 0x4017C2: execute_test_file (nft-parsing-test.c:270)
==26018== by 0x400EBB: main (nft-parsing-test.c:332)
==26018== Address 0x5c34a78 is 20 bytes after a block of size 4 alloc'd
==26018== at 0x4C274A0: malloc (vg_replace_malloc.c:291)
==26018== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
==26018== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0)
Signed-off-by: Ana Rey <anarey@gmail.com>
---
src/expr/target.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/expr/target.c b/src/expr/target.c
index 36e37de..072f25f 100644
--- a/src/expr/target.c
+++ b/src/expr/target.c
@@ -42,8 +42,8 @@ nft_rule_expr_target_set(struct nft_rule_expr *e, uint16_t type,
switch(type) {
case NFT_EXPR_TG_NAME:
- memcpy(tg->name, data, XT_EXTENSION_MAXNAMELEN);
- tg->name[XT_EXTENSION_MAXNAMELEN-1] = '\0';
+ memcpy(tg->name, data, strlen(data));
+ tg->name[strlen(data)+1] = '\0';
break;
case NFT_EXPR_TG_REV:
tg->rev = *((uint32_t *)data);
--
1.9.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [libnftnl PATCH] tests: Fix a memory leak
2014-04-13 18:08 [libnftnl PATCH] target: Fix an invalid read Ana Rey
@ 2014-04-13 18:08 ` Ana Rey
2014-04-14 8:49 ` Pablo Neira Ayuso
2014-04-13 18:21 ` [libnftnl PATCH] target: Fix an invalid read Florian Westphal
1 sibling, 1 reply; 4+ messages in thread
From: Ana Rey @ 2014-04-13 18:08 UTC (permalink / raw)
To: netfilter-devel; +Cc: Ana Rey
Free nft_parse_err struct when there is an error in execute_test function.
It solves the following memory leak shown by valgrind.
==7845== 24 bytes in 1 blocks are still reachable in loss record 1 of 2
==7845== at 0x4C29590: calloc (vg_replace_malloc.c:618)
==7845== by 0x401740: execute_test_file (nft-parsing-test.c:249)
==7845== by 0x400EBB: main (nft-parsing-test.c:330)
Signed-off-by: Ana Rey <anarey@gmail.com>
---
tests/nft-parsing-test.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tests/nft-parsing-test.c b/tests/nft-parsing-test.c
index 952ffbf..2a15109 100644
--- a/tests/nft-parsing-test.c
+++ b/tests/nft-parsing-test.c
@@ -263,6 +263,7 @@ static int execute_test_file(const char *filename)
printf("\033[32mOK\e[0m\n");
}
}
+ nft_parse_err_free(err);
exit(EXIT_FAILURE);
}
if (strcmp(&filename[len-5], ".json") == 0) {
@@ -273,6 +274,7 @@ static int execute_test_file(const char *filename)
printf("\033[32mOK\e[0m\n");
}
}
+ nft_parse_err_free(err);
exit(EXIT_FAILURE);
}
--
1.9.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [libnftnl PATCH] tests: Fix a memory leak
2014-04-13 18:08 ` [libnftnl PATCH] tests: Fix a memory leak Ana Rey
@ 2014-04-14 8:49 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2014-04-14 8:49 UTC (permalink / raw)
To: Ana Rey; +Cc: netfilter-devel
On Sun, Apr 13, 2014 at 08:08:34PM +0200, Ana Rey wrote:
> Free nft_parse_err struct when there is an error in execute_test function.
>
> It solves the following memory leak shown by valgrind.
>
> ==7845== 24 bytes in 1 blocks are still reachable in loss record 1 of 2
> ==7845== at 0x4C29590: calloc (vg_replace_malloc.c:618)
> ==7845== by 0x401740: execute_test_file (nft-parsing-test.c:249)
> ==7845== by 0x400EBB: main (nft-parsing-test.c:330)
Applied, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [libnftnl PATCH] target: Fix an invalid read.
2014-04-13 18:08 [libnftnl PATCH] target: Fix an invalid read Ana Rey
2014-04-13 18:08 ` [libnftnl PATCH] tests: Fix a memory leak Ana Rey
@ 2014-04-13 18:21 ` Florian Westphal
1 sibling, 0 replies; 4+ messages in thread
From: Florian Westphal @ 2014-04-13 18:21 UTC (permalink / raw)
To: Ana Rey; +Cc: netfilter-devel
Ana Rey <anarey@gmail.com> wrote:
> --- a/src/expr/target.c
> +++ b/src/expr/target.c
> @@ -42,8 +42,8 @@ nft_rule_expr_target_set(struct nft_rule_expr *e, uint16_t type,
>
> switch(type) {
> case NFT_EXPR_TG_NAME:
> - memcpy(tg->name, data, XT_EXTENSION_MAXNAMELEN);
> - tg->name[XT_EXTENSION_MAXNAMELEN-1] = '\0';
> + memcpy(tg->name, data, strlen(data));
This can overflow tg->name, since the size of the source
is tested instead of destination.
What about:
snprintf(tg->name, sizeof(tg->name), "%.*s", data_len, (const char *) data);
?
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-04-14 8:49 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-04-13 18:08 [libnftnl PATCH] target: Fix an invalid read Ana Rey
2014-04-13 18:08 ` [libnftnl PATCH] tests: Fix a memory leak Ana Rey
2014-04-14 8:49 ` Pablo Neira Ayuso
2014-04-13 18:21 ` [libnftnl PATCH] target: Fix an invalid read Florian Westphal
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.