Re: [oops] in text matching

[Pablo Neira Ayuso <pablo@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 1129 bytes --]

Hi Patrick,

Patrick McHardy wrote:
> Patrick McHardy wrote:
>> Andrei Popa wrote:
>>> On Sat, 2007-11-10 at 13:57 +0100, Patrick McHardy wrote:
>>>> Please try this patch.
>>>
>>> it's ok now:
>>>
>>> test ~ # iptables -I INPUT -p tcp --dport 80 -m string --algo bm
>>> --string "$MyNick" -j DROP
>>> iptables: Invalid argument
>>
>>
>> Thanks, thats whats expected. The patch is suboptimal though
>> since it should really allow patterns of length zero. Pablo,
>> the naive approach would be to ignore patlen == 0 in the
>> initialization path and return the current position in bm_find().
>> But I'm guessing there's a better way to handle this case,
>> could you look into this please? Thanks.
> 
> 
> Pablo? I would prefer to get this fixed before 2.6.24, unless
> there's a better fix I'm going to include my patch to reject
> pattern lengths of 0. Thanks.

Sorry for the late reply. Why should we accept zero length patterns?
Would you consider this patch? It keeps consistent the return value of
all textsearch approaches when a zero length pattern is passed.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers

[-- Attachment #2: y --]
[-- Type: text/plain, Size: 1337 bytes --]

[PATCH] Do not allow zero length patterns in the textsearch infrastructure

If a zero length pattern is passed then return EINVAL.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/lib/textsearch.c b/lib/textsearch.c
index 88c98a2..be8bda3 100644
--- a/lib/textsearch.c
+++ b/lib/textsearch.c
@@ -7,7 +7,7 @@
  *		2 of the License, or (at your option) any later version.
  *
  * Authors:	Thomas Graf <tgraf@suug.ch>
- * 		Pablo Neira Ayuso <pablo@eurodev.net>
+ * 		Pablo Neira Ayuso <pablo@netfilter.org>
  *
  * ==========================================================================
  *
@@ -250,7 +250,8 @@ unsigned int textsearch_find_continuous(struct ts_config *conf,
  *       the various search algorithms.
  *
  * Returns a new textsearch configuration according to the specified
- *         parameters or a ERR_PTR().
+ * parameters or a ERR_PTR(). If a zero length pattern is passed, this
+ * function returns EINVAL.
  */
 struct ts_config *textsearch_prepare(const char *algo, const void *pattern,
 				     unsigned int len, gfp_t gfp_mask, int flags)
@@ -259,6 +260,9 @@ struct ts_config *textsearch_prepare(const char *algo, const void *pattern,
 	struct ts_config *conf;
 	struct ts_ops *ops;
 	
+	if (len == 0)
+		return ERR_PTR(-EINVAL);
+
 	ops = lookup_ts_algo(algo);
 #ifdef CONFIG_KMOD
 	/*