iptables/bugfix-add-check-fw-in-entry.patch

From cbc3a30711701f0e8d7f5df14f84adfb2c9fec1f Mon Sep 17 00:00:00 2001
From: majun <majun65@huawei.com>
Date: Fri, 16 Apr 2021 14:52:42 +0800
Subject: [PATCH] 

iptables: add null check for fw in X_entry
If the fw pointer is empty, a core dump occurs.

---
 iptables/ip6tables.c | 21 +++++++++++++++++++++
 iptables/iptables.c  | 20 ++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
index 345af45..5885d41 100644
--- a/iptables/ip6tables.c
+++ b/iptables/ip6tables.c
@@ -218,6 +218,10 @@ append_entry(const xt_chainlabel chain,
 	unsigned int i, j;
 	int ret = 1;
 
+        if (!fw) {
+                return 0;
+        }
+
 	for (i = 0; i < nsaddrs; i++) {
 		fw->ipv6.src = saddrs[i];
 		fw->ipv6.smsk = smasks[i];
@@ -242,6 +246,11 @@ replace_entry(const xt_chainlabel chain,
 	      int verbose,
 	      struct xtc_handle *handle)
 {
+
+        if (!fw) {
+                return 0;
+        }
+
 	fw->ipv6.src = *saddr;
 	fw->ipv6.dst = *daddr;
 	fw->ipv6.smsk = *smask;
@@ -268,6 +277,10 @@ insert_entry(const xt_chainlabel chain,
 	unsigned int i, j;
 	int ret = 1;
 
+	 if (!fw) {
+                return 0;
+        }
+
 	for (i = 0; i < nsaddrs; i++) {
 		fw->ipv6.src = saddrs[i];
 		fw->ipv6.smsk = smasks[i];
@@ -301,6 +314,10 @@ delete_entry(const xt_chainlabel chain,
 	int ret = 1;
 	unsigned char *mask;
 
+	 if (!fw) {
+                return 0;
+        }
+
 	mask = make_delete_mask(matches, target, sizeof(*fw));
 	for (i = 0; i < nsaddrs; i++) {
 		fw->ipv6.src = saddrs[i];
@@ -331,6 +348,10 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw,
 	int ret = 1;
 	unsigned char *mask;
 
+	 if (!fw) {
+                return 0;
+        }
+
 	mask = make_delete_mask(matches, target, sizeof(fw));
 	for (i = 0; i < nsaddrs; i++) {
 		fw->ipv6.src = saddrs[i];
diff --git a/iptables/iptables.c b/iptables/iptables.c
index 6f7b347..0d302e5 100644
--- a/iptables/iptables.c
+++ b/iptables/iptables.c
@@ -217,6 +217,10 @@ append_entry(const xt_chainlabel chain,
 	unsigned int i, j;
 	int ret = 1;
 
+        if (!fw) {
+                return 0;
+        }
+
 	for (i = 0; i < nsaddrs; i++) {
 		fw->ip.src.s_addr = saddrs[i].s_addr;
 		fw->ip.smsk.s_addr = smasks[i].s_addr;
@@ -241,6 +245,10 @@ replace_entry(const xt_chainlabel chain,
 	      int verbose,
 	      struct xtc_handle *handle)
 {
+        if (!fw) {
+                return 0;
+        }
+
 	fw->ip.src.s_addr = saddr->s_addr;
 	fw->ip.dst.s_addr = daddr->s_addr;
 	fw->ip.smsk.s_addr = smask->s_addr;
@@ -267,6 +275,10 @@ insert_entry(const xt_chainlabel chain,
 	unsigned int i, j;
 	int ret = 1;
 
+        if (!fw) {
+                return 0;
+        }
+
 	for (i = 0; i < nsaddrs; i++) {
 		fw->ip.src.s_addr = saddrs[i].s_addr;
 		fw->ip.smsk.s_addr = smasks[i].s_addr;
@@ -300,6 +312,10 @@ delete_entry(const xt_chainlabel chain,
 	int ret = 1;
 	unsigned char *mask;
 
+       if (!fw) {
+                return 0;
+        }
+
 	mask = make_delete_mask(matches, target, sizeof(*fw));
 	for (i = 0; i < nsaddrs; i++) {
 		fw->ip.src.s_addr = saddrs[i].s_addr;
@@ -330,6 +346,10 @@ check_entry(const xt_chainlabel chain, struct ipt_entry *fw,
 	int ret = 1;
 	unsigned char *mask;
 
+    if (!fw) {
+                return 0;
+        }
+
 	mask = make_delete_mask(matches, target, sizeof(*fw));
 	for (i = 0; i < nsaddrs; i++) {
 		fw->ip.src.s_addr = saddrs[i].s_addr;
-- 
2.23.0