[PATCH] nft: arp: fix STRING_OVERFLOW

[PATCH] nft: arp: fix STRING_OVERFLOW

[Giuseppe Longo]

This patch replace strcat with strncat and strcpy with strncpy
fixing possible string overflow.

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
 iptables/nft-arp.c     |    4 ++--
 iptables/xtables-arp.c |    3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
index 08f8814..9792fda 100644
--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
@@ -459,7 +459,7 @@ nft_arp_print_firewall(struct nft_rule *r, unsigned int num,
 			sprintf(buf, "%s", addr_to_dotted(&(fw.arp.src)));
 		else
 			sprintf(buf, "%s", addr_to_anyname(&(fw.arp.src)));
-		strcat(buf, mask_to_dotted(&(fw.arp.smsk)));
+		strncat(buf, mask_to_dotted(&(fw.arp.smsk)), sizeof(buf) - strlen(buf) -1);
 		printf("-s %s ", buf);
 	}
 
@@ -483,7 +483,7 @@ after_devsrc:
 			sprintf(buf, "%s", addr_to_dotted(&(fw.arp.tgt)));
 		else
 			sprintf(buf, "%s", addr_to_anyname(&(fw.arp.tgt)));
-		strcat(buf, mask_to_dotted(&(fw.arp.tmsk)));
+		strncat(buf, mask_to_dotted(&(fw.arp.tmsk)),  sizeof(buf) - strlen(buf) -1);
 		printf("-d %s ", buf);
 	}
 
diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
index 411a699..18f285c 100644
--- a/iptables/xtables-arp.c
+++ b/iptables/xtables-arp.c
@@ -847,7 +847,8 @@ static struct xtables_target *command_jump(struct arpt_entry *fw,
 
 	target->t = xtables_calloc(1, size);
 	target->t->u.target_size = size;
-	strcpy(target->t->u.user.name, jumpto);
+	strncpy(target->t->u.user.name, jumpto, sizeof(target->t->u.user.name));
+	target->t->u.user.name[sizeof(target->t->u.user.name)-1] = '\0';
 	target->t->u.user.revision = target->revision;
 
 	xs_init_target(target);
-- 
1.7.8.6

Re: [PATCH] nft: arp: fix STRING_OVERFLOW

[Tomasz Bursztyka]

Hi Giuseppe Longo a écrit :


> This patch replace strcat with strncat and strcpy with strncpy
> fixing possible string overflow.

Can you remind in the commit message that this patch is a backport of 
the patch http://patchwork.ozlabs.org/patch/279672/ ?
(I mean: name the original author)

Thanks,

Tomasz
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] nft: arp: fix STRING_OVERFLOW

[Pablo Neira Ayuso]

On Mon, Oct 14, 2013 at 09:14:27AM +0300, Tomasz Bursztyka wrote:
> Hi Giuseppe Longo a écrit :
> 
> 
> >This patch replace strcat with strncat and strcpy with strncpy
> >fixing possible string overflow.
> 
> Can you remind in the commit message that this patch is a backport
> of the patch http://patchwork.ozlabs.org/patch/279672/ ?
> (I mean: name the original author)

I have applied this patch including this information.

As Tomasz said. giving credits is a good practise, please do so in the
future, and address Tomasz requests otherwise I may discard your
patches next time if you don't do so. Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html