[PATCH ulogd2] ulogd: fix crash when ipv4 packet is truncated

[PATCH ulogd2] ulogd: fix crash when ipv4 packet is truncated

[Liping Zhang]

From: Liping Zhang <liping.zhang@spreadtrum.com>

If ipv4 packet is truncated, we should not try to dereference the
iph pointer. Otherwise, if the user add such iptables rules
"-j NFLOG --nflog-size 0", we will dereference the NULL pointer
and crash may happen.

Reported-by: Chris Caputo <ccaputo@alt.net>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
---
 filter/raw2packet/ulogd_raw2packet_BASE.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/filter/raw2packet/ulogd_raw2packet_BASE.c b/filter/raw2packet/ulogd_raw2packet_BASE.c
index 8a6180c..fd2665a 100644
--- a/filter/raw2packet/ulogd_raw2packet_BASE.c
+++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
@@ -717,7 +717,7 @@ static int _interp_iphdr(struct ulogd_pluginstance *pi, uint32_t len)
 	struct ulogd_key *ret = pi->output.keys;
 	struct iphdr *iph =
 		ikey_get_ptr(&pi->input.keys[INKEY_RAW_PCKT]);
-	void *nexthdr = (uint32_t *)iph + iph->ihl;
+	void *nexthdr;
 
 	if (len < sizeof(struct iphdr) || len <= (uint32_t)(iph->ihl * 4))
 		return ULOGD_IRET_OK;
@@ -734,6 +734,7 @@ static int _interp_iphdr(struct ulogd_pluginstance *pi, uint32_t len)
 	okey_set_u16(&ret[KEY_IP_ID], ntohs(iph->id));
 	okey_set_u16(&ret[KEY_IP_FRAGOFF], ntohs(iph->frag_off));
 
+	nexthdr = (uint32_t *)iph + iph->ihl;
 	switch (iph->protocol) {
 	case IPPROTO_TCP:
 		_interp_tcp(pi, nexthdr, len);
-- 
2.5.5

[PATCH ulogd2] ulogd: fix crash when ipv4 packet is truncated

[Liping Zhang]

From: Liping Zhang <liping.zhang@spreadtrum.com>

If ipv4 packet is truncated, we should not try to dereference the
iph pointer. Otherwise, if the user add such iptables rules
"-j NFLOG --nflog-size 0", we will dereference the NULL pointer
and crash may happen.

Reported-by: Chris Caputo <ccaputo@alt.net>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
---
 Sorry to redeliver this patch, my mail server told me that it failed.

 filter/raw2packet/ulogd_raw2packet_BASE.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/filter/raw2packet/ulogd_raw2packet_BASE.c b/filter/raw2packet/ulogd_raw2packet_BASE.c
index 8a6180c..fd2665a 100644
--- a/filter/raw2packet/ulogd_raw2packet_BASE.c
+++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
@@ -717,7 +717,7 @@ static int _interp_iphdr(struct ulogd_pluginstance *pi, uint32_t len)
 	struct ulogd_key *ret = pi->output.keys;
 	struct iphdr *iph =
 		ikey_get_ptr(&pi->input.keys[INKEY_RAW_PCKT]);
-	void *nexthdr = (uint32_t *)iph + iph->ihl;
+	void *nexthdr;
 
 	if (len < sizeof(struct iphdr) || len <= (uint32_t)(iph->ihl * 4))
 		return ULOGD_IRET_OK;
@@ -734,6 +734,7 @@ static int _interp_iphdr(struct ulogd_pluginstance *pi, uint32_t len)
 	okey_set_u16(&ret[KEY_IP_ID], ntohs(iph->id));
 	okey_set_u16(&ret[KEY_IP_FRAGOFF], ntohs(iph->frag_off));
 
+	nexthdr = (uint32_t *)iph + iph->ihl;
 	switch (iph->protocol) {
 	case IPPROTO_TCP:
 		_interp_tcp(pi, nexthdr, len);
-- 
2.5.5

Re: [PATCH ulogd2] ulogd: fix crash when ipv4 packet is truncated

[Pablo Neira Ayuso]

On Tue, Oct 11, 2016 at 10:22:27PM +0800, Liping Zhang wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> If ipv4 packet is truncated, we should not try to dereference the
> iph pointer. Otherwise, if the user add such iptables rules
> "-j NFLOG --nflog-size 0", we will dereference the NULL pointer
> and crash may happen.

With Eric's permission, I'm applying this. Thanks.