[PATCH iproute2] nstat: Fix NULL Pointer Dereference

[PATCH iproute2] nstat: Fix NULL Pointer Dereference

[李子奥]

The vulnerability happens in load_ugly_table(), misc/nstat.c, in the latest version of iproute2.
The vulnerability can be triggered by:
1. db is set to NULL at struct nstat_ent *db = NULL;
2. n is set to NULL at n = db;
3. NULL dereference of variable n happens at sscanf(p+1, "%llu", &n->val) != 1

Subject: [PATCH] Fix Null Dereference when no entries are specified

Signed-off-by: Ziao Li <leeziao0331@gmail.com>
---
misc/nstat.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/misc/nstat.c b/misc/nstat.c
index fce3e9c1..b2e19bde 100644
--- a/misc/nstat.c
+++ b/misc/nstat.c
@@ -218,6 +218,10 @@ static void load_ugly_table(FILE *fp)
           p = next;
       }
       n = db;
+       if (n == NULL) {
+           fprintf(stderr, "Error: Invalid input – line has ':' but no entries. Add values after ':'.\n");
+           exit(-2);
+       }
       nread = getline(&buf, &buflen, fp);
       if (nread == -1) {
           fprintf(stderr, "%s:%d: error parsing history file\n",
--
2.34.1

Re: [PATCH iproute2] nstat: Fix NULL Pointer Dereference

[Stephen Hemminger]

On Sat, 5 Apr 2025 17:42:20 +0800
"李子奥" <23110240084@m.fudan.edu.cn> wrote:

> The vulnerability happens in load_ugly_table(), misc/nstat.c, in the latest version of iproute2.
> The vulnerability can be triggered by:
> 1. db is set to NULL at struct nstat_ent *db = NULL;
> 2. n is set to NULL at n = db;
> 3. NULL dereference of variable n happens at sscanf(p+1, "%llu", &n->val) != 1
> 
> Subject: [PATCH] Fix Null Dereference when no entries are specified
> 
> Signed-off-by: Ziao Li <leeziao0331@gmail.com>
> ---
> misc/nstat.c | 4 ++++
> 1 file changed, 4 insertions(+)
> 
> diff --git a/misc/nstat.c b/misc/nstat.c
> index fce3e9c1..b2e19bde 100644
> --- a/misc/nstat.c
> +++ b/misc/nstat.c
> @@ -218,6 +218,10 @@ static void load_ugly_table(FILE *fp)
>            p = next;
>        }
>        n = db;
> +       if (n == NULL) {
> +           fprintf(stderr, "Error: Invalid input – line has ':' but no entries. Add values after ':'.\n");
> +           exit(-2);
> +       }
>        nread = getline(&buf, &buflen, fp);
>        if (nread == -1) {
>            fprintf(stderr, "%s:%d: error parsing history file\n",
> --
> 2.34.1

Better, but your mailer is still confusing the patch.
You may have to resort to using an attachment.

Also, iproute2 uses kernel coding style and indentation is done with
tabs not spaces.

If this is all too hard for you to fix, I can just do it manually.

Re: Re: [PATCH iproute2] nstat: Fix NULL Pointer Dereference

[ZiAo Li]

Thank you for the review and sorry for the wrong format. I will look into the patching procedure carefully again and resubmit.

[PATCH iproute2] nstat: Fix NULL Pointer Dereference

[Ziao Li]

The vulnerability happens in load_ugly_table(), misc/nstat.c, in the
latest version of iproute2.
The vulnerability can be triggered by:
1. db is set to NULL at struct nstat_ent *db = NULL;
2. n is set to NULL at n = db;
3. NULL dereference of variable n happens at sscanf(p+1, "%llu", &n->val) != 1

Subject: [PATCH] Fix Null Dereference when no entries are specified
Signed-off-by: Ziao Li <leeziao0331@gmail.com>
---
 misc/nstat.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/misc/nstat.c b/misc/nstat.c
index fce3e9c1..b2e19bde 100644
--- a/misc/nstat.c
+++ b/misc/nstat.c
@@ -218,6 +218,10 @@ static void load_ugly_table(FILE *fp)
            p = next;
        }
        n = db;
+       if (n == NULL) {
+           fprintf(stderr, "Error: Invalid input – line has ':' but
no entries. Add values after ':'.\n");
+           exit(-2);
+       }
        nread = getline(&buf, &buflen, fp);
        if (nread == -1) {
            fprintf(stderr, "%s:%d: error parsing history file\n",
-- 
2.34.1

Re: [PATCH iproute2] nstat: Fix NULL Pointer Dereference

[Stephen Hemminger]

On Mon, 24 Mar 2025 16:26:48 +0800
Ziao Li <leeziao0331@gmail.com> wrote:

> The vulnerability happens in load_ugly_table(), misc/nstat.c, in the
> latest version of iproute2.
> The vulnerability can be triggered by:
> 1. db is set to NULL at struct nstat_ent *db = NULL;
> 2. n is set to NULL at n = db;
> 3. NULL dereference of variable n happens at sscanf(p+1, "%llu", &n->val) != 1
> 
> Subject: [PATCH] Fix Null Dereference when no entries are specified
> Signed-off-by: Ziao Li <leeziao0331@gmail.com>
> ---
>  misc/nstat.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/misc/nstat.c b/misc/nstat.c
> index fce3e9c1..b2e19bde 100644
> --- a/misc/nstat.c
> +++ b/misc/nstat.c
> @@ -218,6 +218,10 @@ static void load_ugly_table(FILE *fp)
>             p = next;
>         }
>         n = db;
> +       if (n == NULL) {
> +           fprintf(stderr, "Error: Invalid input – line has ':' but
> no entries. Add values after ':'.\n");
> +           exit(-2);
> +       }
>         nread = getline(&buf, &buflen, fp);
>         if (nread == -1) {
>             fprintf(stderr, "%s:%d: error parsing history file\n",

Your mailer is corrupting patches by adding line breaks:
 $ git am --sign /tmp/nstat.patch
Applying: nstat: Fix NULL Pointer Dereference
error: corrupt patch at line 15
Patch failed at 0001 nstat: Fix NULL Pointer Dereference