From owner-freebsd-bugs@FreeBSD.ORG Fri Jan 5 14:50:15 2007 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 9849116A417 for ; Fri, 5 Jan 2007 14:50:15 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40]) by mx1.freebsd.org (Postfix) with ESMTP id 77CAD13C4B5 for ; Fri, 5 Jan 2007 14:50:15 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l05EoFQO092570 for ; Fri, 5 Jan 2007 14:50:15 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l05EoFqV092569; Fri, 5 Jan 2007 14:50:15 GMT (envelope-from gnats) Resent-Date: Fri, 5 Jan 2007 14:50:15 GMT Resent-Message-Id: <200701051450.l05EoFqV092569@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Igor Anishchuk Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 7110416A40F for ; Fri, 5 Jan 2007 14:45:05 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [69.147.83.33]) by mx1.freebsd.org (Postfix) with ESMTP id 5209F13C442 for ; Fri, 5 Jan 2007 14:45:05 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l05Ej5bB003587 for ; Fri, 5 Jan 2007 14:45:05 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id l05Ej4Gg003586; Fri, 5 Jan 2007 14:45:04 GMT (envelope-from nobody) Message-Id: <200701051445.l05Ej4Gg003586@www.freebsd.org> Date: Fri, 5 Jan 2007 14:45:04 GMT From: Igor Anishchuk To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.0 Cc: Subject: misc/107565: input string parsing mistake X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Jan 2007 14:50:15 -0000 >Number: 107565 >Category: misc >Synopsis: input string parsing mistake >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Jan 05 14:50:14 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Igor Anishchuk >Release: FreeBSD 6.2-PRERELEASE #5: Tue Jan 2 15:00:46 EET 2007 >Organization: F-Secure Corporation >Environment: FreeBSD fsfwc002.test 6.2-PRERELEASE FreeBSD 6.2-PRERELEASE #5: Tue Jan 2 15:00:46 EET 2007 anisig@fsfwc002.test:/usr/obj/usr/src/sys/FSFWC amd64 >Description: It is impossible to specify more than one IP-address and mask in colon-separated form. During my investigation I've found that /xx form uses the same dangerous parsing method and it's work relies only on atoi() behavior hack. As I see that the parsing works quite stupidly. It just passes entire line after delimiter to external function (either atoi() or inet_aton()) and the last one just can't parse the line of it contains anything else after the current pair of address:mask. The file in question is /usr/src/sbin/ipfw/ipfw2.c, the lines starting from #2714. >How-To-Repeat: ipfw add count all from any to 192.168.0.0/24,192.168.2.0:255.255.255.0 The previous one works well. The next one doesn't. ipfw add count all from any to 192.168.0.0:255.255.255.0,192.168.2.0:255.255.255.0 >Fix: fsfwc002# diff /usr/src/sbin/ipfw/ipfw2.c.old /usr/src/sbin/ipfw/ipfw2.c 2722a2723,2731 > char t[15]; > int ti; > > for(ti=0; ti<16 && p[ti] != 0; ti++){ > t[ti]=p[ti+1]; > if(t[ti] != '.' && (t[ti] < '0' || t[ti] > '9')) > t[ti] = '\0'; > } > 2734c2743 < if (!inet_aton(p, (struct in_addr *)&d[1])) --- > if (!inet_aton(t, (struct in_addr *)&d[1])) 2738c2747 < masklen = atoi(p); --- > masklen = atoi(t); >Release-Note: >Audit-Trail: >Unformatted: