[iproute PATCH] iproute: Abort if nexthop cannot be parsed

* [iproute PATCH] iproute: Abort if nexthop cannot be parsed
@ 2018-04-11  9:43 Jakub Sitnicki
  2018-04-17  0:00 ` Stephen Hemminger
  0 siblings, 1 reply; 2+ messages in thread
From: Jakub Sitnicki @ 2018-04-11  9:43 UTC (permalink / raw)
  To: Stephen Hemminger; +Cc: netdev

Attempt to add a multipath route where a nexthop definition refers to a
non-existent device causes 'ip' to crash and burn due to stack buffer
overflow:

  # ip -6 route add fd00::1/64 nexthop dev fake1
  Cannot find device "fake1"
  Cannot find device "fake1"
  Cannot find device "fake1"
  ...
  Segmentation fault (core dumped)

Don't ignore errors from the helper routine that parses the nexthop
definition, and abort immediately if parsing fails.

Signed-off-by: Jakub Sitnicki <jkbs@redhat.com>
---
 ip/iproute.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ip/iproute.c b/ip/iproute.c
index 1d8fd815..44351bc5 100644
--- a/ip/iproute.c
+++ b/ip/iproute.c
@@ -1038,7 +1038,10 @@ static int parse_nexthops(struct nlmsghdr *n, struct rtmsg *r,
 		memset(rtnh, 0, sizeof(*rtnh));
 		rtnh->rtnh_len = sizeof(*rtnh);
 		rta->rta_len += rtnh->rtnh_len;
-		parse_one_nh(n, r, rta, rtnh, &argc, &argv);
+		if (parse_one_nh(n, r, rta, rtnh, &argc, &argv)) {
+			fprintf(stderr, "Error: cannot parse nexthop\n");
+			exit(-1);
+		}
 		rtnh = RTNH_NEXT(rtnh);
 	}
 
-- 
2.14.3

^ permalink raw reply related	[flat|nested] 2+ messages in thread