From owner-freebsd-ipfw@FreeBSD.ORG  Tue May 10 18:50:07 2005
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D2B1C16A4D1
	for <freebsd-ipfw@hub.freebsd.org>;
	Tue, 10 May 2005 18:50:07 +0000 (GMT)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 9526C43D31
	for <freebsd-ipfw@hub.freebsd.org>;
	Tue, 10 May 2005 18:50:07 +0000 (GMT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j4AIo75U094517
	for <freebsd-ipfw@freefall.freebsd.org>; Tue, 10 May 2005 18:50:07 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j4AIo7SX094516;
	Tue, 10 May 2005 18:50:07 GMT
	(envelope-from gnats)
Date: Tue, 10 May 2005 18:50:07 GMT
Message-Id: <200505101850.j4AIo7SX094516@freefall.freebsd.org>
To: freebsd-ipfw@FreeBSD.org
From: Jon Simola <jsimola@gmail.com>
Subject: Re: kern/73276: ipfw2 vulnerability (parser error)
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Jon Simola <jsimola@gmail.com>
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 10 May 2005 18:50:08 -0000

The following reply was made to PR kern/73276; it has been noted by GNATS.

From: Jon Simola <jsimola@gmail.com>
To: bug-followup@freebsd.org
Cc:  
Subject: Re: kern/73276: ipfw2 vulnerability (parser error)
Date: Tue, 10 May 2005 11:45:55 -0700

 On 5/10/05, Tilman Linneweh <arved@freebsd.org> wrote:
 
 > Synopsis: ipfw2 vulnerability (parser error)
 >=20
 > Responsible-Changed-From-To: freebsd-bugs->freebsd-ipfw
 > Responsible-Changed-By: arved
 > Responsible-Changed-When: Tue May 10 13:50:30 GMT 2005
 > Responsible-Changed-Why:
 > Over to ipfw mailinglist
 >=20
 > http://www.freebsd.org/cgi/query-pr.cgi?pr=3D73276
 
 More accurately, anything after the closing '}' is ignored by the
 parser. I'm pretty sure this fixes that.
 
 --- ipfw2.c.orig        Tue May 10 08:45:12 2005
 +++ ipfw2.c     Tue May 10 09:53:08 2005
 @@ -2088,8 +2088,11 @@
                        i =3D -1;
                        if (*s =3D=3D '-')
                            i =3D a;
 -                       else if (*s =3D=3D '}')
 +                       else if (*s =3D=3D '}') {
 +                           if (strlen(s) > 1)
 +                               errx(EX_DATAERR, "trailing garbage after '}=
 '");
                            break;
 +                       }
                        av =3D s+1;
                }
                return;
 
 --=20
 Jon Simola
 Systems Administrator
 ABC Communications