Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4f36ea6e authored by Chen Gang's avatar Chen Gang Committed by Pablo Neira Ayuso
Browse files

netfilter: ipt_ULOG: fix non-null terminated string in the nf_log path 



If nf_log uses ipt_ULOG as logging output, we can deliver non-null
terminated strings to user-space since the maximum length of the
prefix that is passed by nf_log is NF_LOG_PREFIXLEN but pm->prefix
is 32 bytes long (ULOG_PREFIX_LEN).

This is actually happening already from nf_conntrack_tcp if ipt_ULOG
is used, since it is passing strings longer than 32 bytes.

Signed-off-by: default avatarChen Gang <gang.chen@asianux.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2a7851bf

net/ipv4/netfilter/ipt_ULOG.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -231,8 +231,10 @@ static void ipt_ulog_packet(struct net *net, 
	put_unaligned(tv.tv_usec, &pm->timestamp_usec);

	put_unaligned(tv.tv_usec, &pm->timestamp_usec);

	put_unaligned(skb->mark, &pm->mark);

	put_unaligned(skb->mark, &pm->mark);

	pm->hook = hooknum;

	pm->hook = hooknum;

	if (prefix != NULL)

	if (prefix != NULL) {

		strncpy(pm->prefix, prefix, sizeof(pm->prefix));

		strncpy(pm->prefix, prefix, sizeof(pm->prefix) - 1);

		pm->prefix[sizeof(pm->prefix) - 1] = '\0';

	}

	else if (loginfo->prefix[0] != '\0')

	else if (loginfo->prefix[0] != '\0')

		strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));

		strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));

	else

	else