Re: Null dereference in ebtables-restore.c

[Phil Sutter <phil@nwl.cc>]

Hi,

On Thu, Dec 18, 2025 at 04:17:39PM +0300, Ilia Kashintsev wrote:
> Hello maintainers! I have found a SEGV in ebtables-restore.c
> 
> It occurs on the following line:
> *strchr(cmdline, '\n') = '\0';
> 
> If '\n' is not present in cmdline, then the result of strchr() is NULL
> with a dereference attempt afterwards.

Thanks for the detailed report!

[...]
> Suggested fix:
> 
> Check strchr() result before trying to dereference it.
> 
> diff --git a/ebtables-restore.c b/ebtables-restore.c
> index bb4d0cf..c97364b 100644
> --- a/ebtables-restore.c
> +++ b/ebtables-restore.c
> @@ -76,7 +76,9 @@ int main(int argc_, char *argv_[])
>                 line++;
>                 if (*cmdline == '#' || *cmdline == '\n')
>                         continue;
> -               *strchr(cmdline, '\n') = '\0';
> +               char *new_line = strchr(cmdline, '\n');
> +               if (new_line)
> +                       *new_line = '\0';
>                 if (*cmdline == '*') {
>                         if (table_nr != -1) {
>                                 ebt_deliver_table(&replace[table_nr]);

How about simply using strchrnul():

--- a/ebtables-restore.c
+++ b/ebtables-restore.c
@@ -17,6 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
+#define _GNU_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -76,7 +77,7 @@ int main(int argc_, char *argv_[])
                line++;
                if (*cmdline == '#' || *cmdline == '\n')
                        continue;
-               *strchr(cmdline, '\n') = '\0';
+               *strchrnul(cmdline, '\n') = '\0';
                if (*cmdline == '*') {
                        if (table_nr != -1) {
                                ebt_deliver_table(&replace[table_nr]);

Cheers, Phil