From owner-freebsd-bugs@FreeBSD.ORG Sun Apr 25 09:10:20 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E38B916A4CE for ; Sun, 25 Apr 2004 09:10:19 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id CC04D43D5F for ; Sun, 25 Apr 2004 09:10:19 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) i3PGAJbv084909 for ; Sun, 25 Apr 2004 09:10:19 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.10/8.12.10/Submit) id i3PGAJso084908; Sun, 25 Apr 2004 09:10:19 -0700 (PDT) (envelope-from gnats) Resent-Date: Sun, 25 Apr 2004 09:10:19 -0700 (PDT) Resent-Message-Id: <200404251610.i3PGAJso084908@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Eugene Grosbein Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1094816A4CE; Sun, 25 Apr 2004 09:07:09 -0700 (PDT) Received: from grosbein.pp.ru (grgw.svzserv.kemerovo.su [213.184.64.130]) by mx1.FreeBSD.org (Postfix) with ESMTP id D1C1843D31; Sun, 25 Apr 2004 09:07:05 -0700 (PDT) (envelope-from eugen@grosbein.pp.ru) Received: from grosbein.pp.ru (eugen@localhost [127.0.0.1]) by grosbein.pp.ru (8.12.11/8.12.11) with ESMTP id i3PG73RK002418; Mon, 26 Apr 2004 00:07:03 +0800 (KRAST) (envelope-from eugen@grosbein.pp.ru) Received: (from eugen@localhost) by grosbein.pp.ru (8.12.11/8.12.11/Submit) id i3PG73as002417; Mon, 26 Apr 2004 00:07:03 +0800 (KRAST) (envelope-from eugen) Message-Id: <200404251607.i3PG73as002417@grosbein.pp.ru> Date: Mon, 26 Apr 2004 00:07:03 +0800 (KRAST) From: Eugene Grosbein To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 cc: luigy@FreeBSD.org Subject: bin/65961: ipfw2 memory corruption inside add() X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Eugene Grosbein List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Apr 2004 16:10:20 -0000 >Number: 65961 >Category: bin >Synopsis: ipfw2 memory corruption inside add() >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Apr 25 09:10:19 PDT 2004 >Closed-Date: >Last-Modified: >Originator: Eugene Grosbein >Release: FreeBSD 4.10-PRERELEASE i386 >Organization: Svyaz Service JSC >Environment: System: FreeBSD grosbein.pp.ru 4.10-PRERELEASE FreeBSD 4.10-PRERELEASE #1: Sun Apr 25 13:29:39 KRAST 2004 eu@grosbein.pp.ru:/usr/local/obj/usr/local/src/sys/DADV i386 >Description: ipfw2 supports or-blocks that may have variable length. A function add() in ipfw2.c uses fixed-length arrays and does not check for overflows. Hence, memory structure corruption occurs while very long or-block is passed from a command line. This results in segmentation faults or even enless loops when ipfw2 eats all available CPU cycles. >How-To-Repeat: The next script takes a number (n) and creates syntactical correct 'ipfw add' rule with or-block containing of n+1 IP address. #!/bin/sh args="add 60001 count ip from any to { " for i in `jot $1 1` do args="${args}127.0.0.$i or " done args="${args}127.0.1.1 }"; ipfw delete 60001 echo ipfw $args ipfw $args "./test 121" works. "./test 123" leads to corruption of actbuf[] and th cycle does not finish because variable i gets zero value: /* * copy all other actions */ for (src = (ipfw_insn *)actbuf; src != action; src += i) { i = F_LEN(src); bcopy(src, dst, i * sizeof(uint32_t)); dst += i; } "./test 500" leads to segmentation fault inside exit(): Core was generated by pfw'. Program terminated with signal 11, Segmentation fault. #0 0x8072648 in exit () (gdb) bt #0 0x8072648 in exit () #1 0x8054970 in warn () #2 0x80548de in errx () #3 0x804bda0 in fill_ip (cmd=0x808d098, av=0x809e0f0 "127.0.0.256") at /usr/local/src/sbin/ipfw/ipfw2.c:1932 #4 0x804da76 in add_dstip (cmd=0x808d098, av=0x809e0f0 "127.0.0.256") at /usr/local/src/sbin/ipfw/ipfw2.c:2669 #5 0x804e90e in add (ac=492, av=0x809b818) at /usr/local/src/sbin/ipfw/ipfw2.c:3052 #6 0x80505ba in ipfw_main (oldac=1010, oldav=0xbfbfcea4) at /usr/local/src/sbin/ipfw/ipfw2.c:3793 #7 0x8050eb4 in main (ac=1011, av=0xbfbfcea0) at /usr/local/src/sbin/ipfw/ipfw2.c:3966 >Fix: Document limits of or-block length and implement sanity checks. Eugene Grosbein >Release-Note: >Audit-Trail: >Unformatted: