From owner-freebsd-bugs@FreeBSD.ORG Tue Sep 27 20:20:23 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 843B916A420 for ; Tue, 27 Sep 2005 20:20:23 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id D370D43D49 for ; Tue, 27 Sep 2005 20:20:22 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j8RKKM2d003834 for ; Tue, 27 Sep 2005 20:20:22 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j8RKKMSA003833; Tue, 27 Sep 2005 20:20:22 GMT (envelope-from gnats) Resent-Date: Tue, 27 Sep 2005 20:20:22 GMT Resent-Message-Id: <200509272020.j8RKKMSA003833@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Stephen Hurd Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CFF8116A41F for ; Tue, 27 Sep 2005 20:15:42 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9D32043D48 for ; Tue, 27 Sep 2005 20:15:42 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id j8RKFgFt021127 for ; Tue, 27 Sep 2005 20:15:42 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id j8RKFgeQ021126; Tue, 27 Sep 2005 20:15:42 GMT (envelope-from nobody) Message-Id: <200509272015.j8RKFgeQ021126@www.freebsd.org> Date: Tue, 27 Sep 2005 20:15:42 GMT From: Stephen Hurd To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Cc: Subject: misc/86647: natd copy to limied buffer size without checking range X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2005 20:20:23 -0000 >Number: 86647 >Category: misc >Synopsis: natd copy to limied buffer size without checking range >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Sep 27 20:20:22 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Stephen Hurd >Release: 5.3-RELEASE >Organization: >Environment: FreeBSD fw.bbsdev.net 5.3-RELEASE FreeBSD 5.3-RELEASE #4: Fri Sep 2 14:31:49 CST 2005 admin@fw.bbsdev.net:/usr/src/sys/i386/compile/FW i386 >Description: In Setup*Redirect() in natd.c, the params are copied to a fixed-length buffer using strlcpy() then parsed. For large round-robin redirects, 128 is occasionally not enough bytes. natd currently truncates the arguments to 128 bytes and then parses. For a redirect_port such as this: "redirect_port tcp 192.168.0.13:30023,192.168.0.1:30023,192.168.0.7:30023,192.168.0.12:30023,192.168.0.9:30023,192.168.0.4:3002 3 142.165.59.203:telnet" This truncates to an invalid line without a message to that effect. >How-To-Repeat: Add a redirect_* line to a natd config file (or on command-line) with more that 128 chars in the params. >Fix: use strdup() to copy the params, or check param length before copying and throw an error if larger than sizeof(buf)-1 >Release-Note: >Audit-Trail: >Unformatted: