Re: Raw Payload Expressions - out of bounds write?

Sunny73Cr <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <R5drxaQptK9DK89Lt1TmFpDxo86ctD3Pu2WS4wEhXcOZq7yuVqJDxNIc2tZVIx1PJpF15g1AOJCW3gxNIPqlVH6ubbppDWQlzErAa4UP3UI=@protonmail.com>
> Please elaborate as what is wrong here in listing 3.

Within the second line of the rule (@ih,80,16 set @ih,80,16 & 0x3f0 \)

The mask 0x3f0 equates to 1,008 in decimal.
(3 * 16**2) + (15 * 16**1) + (0 * 16^0) = 1,008
Here '**' indicates exponent.

1,008 is far larger than the 34 bit range that I covered.
I understand that within NetFilter, there may be safeguards that which prevent writing beyond array bounds; but, that section of the rule still covers the bits that I did not wish to zero.

Apologies, but I have not checked the code as of yet.

sunny
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.