Re: [1/1] iptables: Fix crash on malformed iptables-restore

[Florian Westphal <fw@strlen.de>]

Oliver Ford <ojford@gmail.com> wrote:
> Fixes the crash reported in Bugzilla #1131 where a malformed
> parameter that specifies the table option can create an invalid
> pointer.
> 
> Improves the tables option check to find a beginning '-' followed by
> a 't' anywhere in the parameter.

> diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
> index 876fe06..70dc7eb 100644
> --- a/iptables/iptables-restore.c
> +++ b/iptables/iptables-restore.c
> @@ -162,8 +162,7 @@ static void add_param_to_argv(char *parsestart)
>  			param_buffer[param_len] = '\0';
>  
>  			/* check if table name specified */
> -			if (!strncmp(param_buffer, "-t", 2)
> -			    || !strncmp(param_buffer, "--table", 8)) {
> +			if (param_buffer[0] == '-' && strchr(param_buffer, 't')) {
>  				xtables_error(PARAMETER_PROBLEM,
>  				"The -t option (seen in line %u) cannot be "
>  				"used in iptables-restore.\n", line);

strchr() can only called if param_buffer[1] != '-', else this breaks
something like:

# Generated by iptables-save v1.6.0 on Thu May 18 00:00:38 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
--delete foo
COMMIT

(use '-n' option to iptables).