[iptables PATCH] libxtables: Promote xtopt_esize_by_type() as xtopt_psize getter

[iptables PATCH] libxtables: Promote xtopt_esize_by_type() as xtopt_psize getter

[Phil Sutter]

Apart from supporting range-types, this getter is convenient to sanitize
array out of bounds access. Use it in xtables_option_metavalidate() to
simplify the code a bit.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 libxtables/xtoptions.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c
index 64d6599af904b..ecaea4ec16cc9 100644
--- a/libxtables/xtoptions.c
+++ b/libxtables/xtoptions.c
@@ -145,8 +145,11 @@ static size_t xtopt_esize_by_type(enum xt_option_type type)
 	case XTTYPE_UINT64RC:
 		return xtopt_psize[XTTYPE_UINT64];
 	default:
-		return xtopt_psize[type];
+		break;
 	}
+	if (type < ARRAY_SIZE(xtopt_psize))
+		return xtopt_psize[type];
+	return 0;
 }
 
 static uint64_t htonll(uint64_t val)
@@ -886,6 +889,8 @@ void xtables_option_parse(struct xt_option_call *cb)
 void xtables_option_metavalidate(const char *name,
 				 const struct xt_option_entry *entry)
 {
+	size_t psize;
+
 	for (; entry->name != NULL; ++entry) {
 		if (entry->id >= CHAR_BIT * sizeof(unsigned int) ||
 		    entry->id >= XT_OPTION_OFFSET_SCALE)
@@ -900,19 +905,18 @@ void xtables_option_metavalidate(const char *name,
 					"Oversight?", name, entry->name);
 			continue;
 		}
-		if (entry->type >= ARRAY_SIZE(xtopt_psize) ||
-		    xtopt_psize[entry->type] == 0)
+
+		psize = xtopt_esize_by_type(entry->type);
+		if (!psize)
 			xt_params->exit_err(OTHER_PROBLEM,
 				"%s: entry type of option \"--%s\" cannot be "
 				"combined with XTOPT_PUT\n",
 				name, entry->name);
-		if (xtopt_psize[entry->type] != -1 &&
-		    xtopt_psize[entry->type] != entry->size)
+		else if (psize != -1 && psize != entry->size)
 			xt_params->exit_err(OTHER_PROBLEM,
 				"%s: option \"--%s\" points to a memory block "
 				"of wrong size (expected %zu, got %zu)\n",
-				name, entry->name,
-				xtopt_psize[entry->type], entry->size);
+				name, entry->name, psize, entry->size);
 	}
 }
 
-- 
2.49.0

Re: [iptables PATCH] libxtables: Promote xtopt_esize_by_type() as xtopt_psize getter

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> Apart from supporting range-types, this getter is convenient to sanitize
> array out of bounds access. Use it in xtables_option_metavalidate() to
> simplify the code a bit.

Reviewed-by: Florian Westphal <fw@strlen.de>

Re: [iptables PATCH] libxtables: Promote xtopt_esize_by_type() as xtopt_psize getter

[Phil Sutter]

On Mon, Jul 21, 2025 at 07:57:56PM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > Apart from supporting range-types, this getter is convenient to sanitize
> > array out of bounds access. Use it in xtables_option_metavalidate() to
> > simplify the code a bit.
> 
> Reviewed-by: Florian Westphal <fw@strlen.de>

Patch applied, thanks!