Re: [PATCH iproute2] nstat: Fix NULL Pointer Dereference

[Stephen Hemminger <stephen@networkplumber.org>]

On Sat, 5 Apr 2025 17:42:20 +0800
"李子奥" <23110240084@m.fudan.edu.cn> wrote:

> The vulnerability happens in load_ugly_table(), misc/nstat.c, in the latest version of iproute2.
> The vulnerability can be triggered by:
> 1. db is set to NULL at struct nstat_ent *db = NULL;
> 2. n is set to NULL at n = db;
> 3. NULL dereference of variable n happens at sscanf(p+1, "%llu", &n->val) != 1
> 
> Subject: [PATCH] Fix Null Dereference when no entries are specified
> 
> Signed-off-by: Ziao Li <leeziao0331@gmail.com>
> ---
> misc/nstat.c | 4 ++++
> 1 file changed, 4 insertions(+)
> 
> diff --git a/misc/nstat.c b/misc/nstat.c
> index fce3e9c1..b2e19bde 100644
> --- a/misc/nstat.c
> +++ b/misc/nstat.c
> @@ -218,6 +218,10 @@ static void load_ugly_table(FILE *fp)
>            p = next;
>        }
>        n = db;
> +       if (n == NULL) {
> +           fprintf(stderr, "Error: Invalid input – line has ':' but no entries. Add values after ':'.\n");
> +           exit(-2);
> +       }
>        nread = getline(&buf, &buflen, fp);
>        if (nread == -1) {
>            fprintf(stderr, "%s:%d: error parsing history file\n",
> --
> 2.34.1

Better, but your mailer is still confusing the patch.
You may have to resort to using an attachment.

Also, iproute2 uses kernel coding style and indentation is done with
tabs not spaces.

If this is all too hard for you to fix, I can just do it manually.