iptables: iptables-xml segfault if missing -A

PATCH Applied Phil Oester 2 participants 2 messages Jan 24, 2014 – Jan 29, 2014 netfilter

Share & tools

Phil Oester

author

2014-01-24 06:06 UTC #0 lore raw

PATCH 1/1 iptables: iptables-xml segfault if missing -A

As pointed out by Bernhard Reutner-Fischer, a malformed line fed to iptables-xml such as the below with a missing space after the -A:

	-APOSTROUTING -d 1.1.1.1/32 -p tcp -j MASQUERADE

causes a segfault. Patch attached.

This closes netfilter bugzilla #886.

Signed-off-by Phil Oester <[email protected]>

iptables/iptables-xml.c +5 -0

index 9628447..c7615ab 100644
@@ -845,6 +845,11 @@ iptables_xml_main(int argc, char *argv[])
 			for (a = 0; a < newargc; a++)
 				DEBUGP("argv[%u]: %s\n", a, newargv[a]);
 
+			if (!chain) {
+				fprintf(stderr, "%s: line %u failed - no chain found\n",
+					prog_name, line);
+				exit(1);
+			}
 			needChain(chain);// Should we explicitly look for -A
 			do_rule(pcnt, bcnt, newargc, newargv, newargvattr);

Pablo Neira Ayuso

maintainer Applied

2014-01-29 19:23 UTC #1 lore raw

Quoted 8 lines · Phil Oester

As pointed out by Bernhard Reutner-Fischer, a malformed line fed to iptables-xml such as the below with a missing space after the -A:
	-APOSTROUTING -d 1.1.1.1/32 -p tcp -j MASQUERADE
causes a segfault. Patch attached.
This closes netfilter bugzilla #886.

Applied, thanks.