* [PATCH] iptables: iptables-xml segfault if missing -A
@ 2014-01-24 6:06 Phil Oester
2014-01-29 19:23 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Phil Oester @ 2014-01-24 6:06 UTC (permalink / raw)
To: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 312 bytes --]
As pointed out by Bernhard Reutner-Fischer, a malformed line fed to
iptables-xml such as the below with a missing space after the -A:
-APOSTROUTING -d 1.1.1.1/32 -p tcp -j MASQUERADE
causes a segfault. Patch attached.
This closes netfilter bugzilla #886.
Signed-off-by: Phil Oester <kernel@linuxace.com>
[-- Attachment #2: patch-iptables-xml --]
[-- Type: text/plain, Size: 537 bytes --]
diff --git a/iptables/iptables-xml.c b/iptables/iptables-xml.c
index 9628447..c7615ab 100644
--- a/iptables/iptables-xml.c
+++ b/iptables/iptables-xml.c
@@ -845,6 +845,11 @@ iptables_xml_main(int argc, char *argv[])
for (a = 0; a < newargc; a++)
DEBUGP("argv[%u]: %s\n", a, newargv[a]);
+ if (!chain) {
+ fprintf(stderr, "%s: line %u failed - no chain found\n",
+ prog_name, line);
+ exit(1);
+ }
needChain(chain);// Should we explicitly look for -A
do_rule(pcnt, bcnt, newargc, newargv, newargvattr);
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] iptables: iptables-xml segfault if missing -A
2014-01-24 6:06 [PATCH] iptables: iptables-xml segfault if missing -A Phil Oester
@ 2014-01-29 19:23 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2014-01-29 19:23 UTC (permalink / raw)
To: Phil Oester; +Cc: netfilter-devel
On Thu, Jan 23, 2014 at 10:06:58PM -0800, Phil Oester wrote:
> As pointed out by Bernhard Reutner-Fischer, a malformed line fed to
> iptables-xml such as the below with a missing space after the -A:
>
> -APOSTROUTING -d 1.1.1.1/32 -p tcp -j MASQUERADE
>
> causes a segfault. Patch attached.
>
> This closes netfilter bugzilla #886.
Applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-01-29 19:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-24 6:06 [PATCH] iptables: iptables-xml segfault if missing -A Phil Oester
2014-01-29 19:23 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).