[PATCH iptables] nft: bridge: fix among buffer overflow when set has no size

The among match parser sizes its pair buffer from NFTNL_SET_DESC_SIZE:

        cnt = nftnl_set_get_u32(s, NFTNL_SET_DESC_SIZE);
        ...
        size = cnt * sizeof(struct nft_among_pair);
        match->m = xtables_calloc(1, size);
        ...
        set_elems_to_among_pairs(among_data->pairs + poff, s, cnt);

NFTNL_SET_DESC_SIZE is the hash-table size hint, which is only present
when the set was created with an explicit "size". A set created without
one (e.g. via plain nft: add set bridge filter s { type ether_addr; })
carries no NFTA_SET_DESC_SIZE, so nftnl_set_get_u32() returns 0. The
buffer is then allocated header-only while set_elems_to_among_pairs()
still walks every element of the set and writes one nft_among_pair each,
overflowing the allocation on the first element. Listing such a ruleset
with ebtables-nft -L (or ebtables-nft-restore) corrupts the heap.

Size the buffer from the actual number of set elements instead, i.e.
exactly what set_elems_to_among_pairs() iterates over. Sets created by
the among match itself are unaffected: their element count equals the
NFTNL_SET_DESC_SIZE that was used before.

Fixes: 26753888720d ("nft: bridge: Rudimental among extension support")
Signed-off-by: Omkhar Arasaratnam <[email protected]>
---
 iptables/nft-ruleparse-bridge.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/iptables/nft-ruleparse-bridge.c b/iptables/nft-ruleparse-bridge.c
index aee08b13..fc877d43 100644
--- a/iptables/nft-ruleparse-bridge.c
+++ b/iptables/nft-ruleparse-bridge.c
@@ -306,6 +306,23 @@ static struct nftnl_set *set_from_lookup_expr(struct nft_xt_ctx *ctx,
        return NULL;
 }

+static uint32_t set_elem_count(const struct nftnl_set *s)
+{
+       struct nftnl_set_elems_iter *iter = nftnl_set_elems_iter_create(s);
+       uint32_t cnt = 0;
+
+       if (!iter)
+               xtables_error(OTHER_PROBLEM,
+                             "BUG: set elems iter allocation failed");
+
+       while (nftnl_set_elems_iter_next(iter))
+               cnt++;
+
+       nftnl_set_elems_iter_destroy(iter);
+
+       return cnt;
+}
+
 static void nft_bridge_parse_lookup(struct nft_xt_ctx *ctx,
                                    struct nftnl_expr *e)
 {
@@ -328,7 +345,10 @@ static void nft_bridge_parse_lookup(struct nft_xt_ctx *ctx,
                                    &is_dst, &have_ip))
                return;

-       cnt = nftnl_set_get_u32(s, NFTNL_SET_DESC_SIZE);
+       /* NFTNL_SET_DESC_SIZE is unset for sets without an explicit size, so
+        * count the actual elements instead of trusting it.
+        */
+       cnt = set_elem_count(s);

        for (ematch = ctx->cs->match_list; ematch; ematch = ematch->next) {
                if (!ematch->ismatch || strcmp(ematch->u.match->name, "among"))
--
2.34.1

— oa