Re: ebtables segfault

On Tue, Oct 17, 2006 at 07:15:16PM +0200, Bart De Schuymer wrote:
> Hi,
> 
> Please try the CVS version, it contains among others two fixes that were
> reported earlier.
> I'll try to release a new rc in the near future.
> 
> cheers,
> Bart
> 
> Op ma, 16-10-2006 te 15:10 +0200, schreef Tino Keitel:
> > Hi,
> > 
> > I upgraded from ebables 2.0.6 to 2.0.8-rc2.
> > 
> > ebtables -L works, but ebtables -A INPUT -j ACCEPT segfaults.
> > 
> > The segfault occurs in ebtables.c:do_command() in this line:
> > 
> > e = entries->entries->next;

This issue is not yet fixed in CVS. It is caused by uninitialized
memory being used.
Explanation: the replace->chains array is initialized to 0/NULL
using calloc on the first allocation (ebt_get_table():740). If the
initial size (EBT_ORI_MAX_CHAINS=10) is exceeded, the array is
re-malloc()ed but not initialized to 0/NULL, so that chains[n>10]
is containing undefined pointers.
The condition in do_command():1183:
  entries = replace->chains[i];
  if (!entries)
    ...
therefore may run over the of the list of really existing chains.
I have attached a patch that uses the num_chains as explicit end
condition. This patch seems to fix the problem (excessive tests
pending).
(Note: I do not think that initializing the new memory allocated
in ebt_double_chains() is an appropriate solution, as this function
is only called once the array is full. Therefore the check for a
NULL pointer would as well fail if num_chains==max_chains).

Best regards,
	Lutz
PS. Mandatory condition to continue with "[Ebtables-user] Vlans" now
fulfilled.
-- 
Dr.-Ing. Lutz Jänicke
CTO
Innominate Security Technologies AG  /protecting industrial networks/
tel: +49.30.6392-3308
fax: +49.30.6392-3307
Albert-Einstein-Str. 14
D-12489 Berlin, Germany
www.innominate.com
---------------------------------------------------------------

Visit us at the SPS/IPC/Drives in Nuernberg

28 - 30 November 2006, Hall 9, Stand 9-125

---------------------------------------------------------------

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

_______________________________________________
Ebtables-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ebtables-user

Index: ebtables.c
===================================================================
RCS file: /cvsroot/ebtables/ebtables2/userspace/ebtables2/ebtables.c,v
retrieving revision 1.81
diff -u -r1.81 ebtables.c
--- ebtables.c	11 Apr 2006 18:22:37 -0000	1.81
+++ ebtables.c	10 Nov 2006 15:39:12 -0000
@@ -1180,6 +1180,8 @@
 			struct ebt_u_entry *e;
 
 			i++;
+			if (i == replace->num_chains)
+				break;
 			entries = replace->chains[i];
 			if (!entries) {
 				if (i < NF_BR_NUMHOOKS)