From df18c48812462ea802d639d2477887055666ee58 Mon Sep 17 00:00:00 2001 From: Marsman1996 Date: Wed, 1 Mar 2023 16:52:35 +0800 Subject: [PATCH 1/3] Add check after call strtok_r --- src/common/cidr.c | 4 ++++ src/common/list.c | 2 +- src/common/mac.c | 2 +- src/common/utils.c | 2 ++ src/tcpedit/portmap.c | 2 +- 5 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/common/cidr.c b/src/common/cidr.c index 59aaf872..4fc8aad2 100644 --- a/src/common/cidr.c +++ b/src/common/cidr.c @@ -295,6 +295,8 @@ parse_cidr(tcpr_cidr_t ** cidrdata, char *cidrin, char *delim) /* first iteration of input using strtok */ network = strtok_r(cidrin, delim, &token); + if (network == NULL) + return 0; *cidrdata = cidr2cidr(network); cidr_ptr = *cidrdata; @@ -362,6 +364,8 @@ parse_endpoints(tcpr_cidrmap_t ** cidrmap1, tcpr_cidrmap_t ** cidrmap2, const ch /* ipv4 mode */ memset(newmap, '\0', NEWMAP_LEN); map = strtok_r(string, ":", &token); + if (map == NULL) + goto done; strlcpy(newmap, "0.0.0.0/0:", NEWMAP_LEN); strlcat(newmap, map, NEWMAP_LEN); diff --git a/src/common/list.c b/src/common/list.c index 303e5a5b..fbd54501 100644 --- a/src/common/list.c +++ b/src/common/list.c @@ -78,7 +78,7 @@ parse_list(tcpr_list_t ** listdata, char *ourstr) second = NULL; /* regex test */ - if (regexec(&preg, this, 0, NULL, 0) != 0) { + if (this == NULL || regexec(&preg, this, 0, NULL, 0) != 0) { warnx("Unable to parse: %s", this); regfree(&preg); return 0; diff --git a/src/common/mac.c b/src/common/mac.c index 3747a174..8ec2df3a 100644 --- a/src/common/mac.c +++ b/src/common/mac.c @@ -117,7 +117,7 @@ macinstring(const char *macstring, const u_char *mac) memset(&tempmac[0], 0, sizeof(tempmac)); tempstr = strtok_r(ourstring, ",", &tok); - if (strlen(tempstr)) { + if (tempstr != NULL && strlen(tempstr)) { mac2hex(tempstr, tempmac, len); if (memcmp(mac, tempmac, len) == 0) { dbgx(3, "Packet matches: " MAC_FORMAT " sending out primary.\n", MAC_STR(tempmac)); diff --git a/src/common/utils.c b/src/common/utils.c index a641939d..fcfddb5e 100644 --- a/src/common/utils.c +++ b/src/common/utils.c @@ -306,6 +306,8 @@ read_hexstring(const char *l2string, u_char *hex, const int hexlen) /* get the first byte */ l2byte = strtok_r(string, ",", &token); + if (l2byte == NULL) + err(-1, "Hex buffer must contain something"); sscanf(l2byte, "%x", &value); if (value > 0xff) errx(-1, "Invalid hex string byte: %s", l2byte); diff --git a/src/tcpedit/portmap.c b/src/tcpedit/portmap.c index 61c0d2a3..ebafe399 100644 --- a/src/tcpedit/portmap.c +++ b/src/tcpedit/portmap.c @@ -194,7 +194,7 @@ parse_portmap(tcpedit_portmap_t ** portmap, const char *ourstr) /* first iteration of input */ substr = strtok_r(ourstrcpy, ",", &token); - if ((*portmap = ports2PORT(substr)) == NULL) { + if (substr == NULL || (*portmap = ports2PORT(substr)) == NULL) { safe_free(ourstrcpy); return 0; } From ecafaac79eb176ce08555493e517bb3845cece6a Mon Sep 17 00:00:00 2001 From: Fred Klassen Date: Sun, 4 Jun 2023 18:30:06 -0700 Subject: [PATCH 2/3] document PR #783 Bugs #782 #784 #785 #786 #787 #788 --- docs/CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/CHANGELOG b/docs/CHANGELOG index 95ad8378..b9f143e1 100644 --- a/docs/CHANGELOG +++ b/docs/CHANGELOG @@ -1,4 +1,5 @@ 06/04/2023 Version 4.4.4-Beta1 + - CVE-2023-27786 bugs caused by strtok_r (#782 #784 #785 #786 #787 #788) - CVE-2023-27783 reachable assert in tcpedit_dlt_cleanup (#780) 01/01/2023 Version 4.4.3 From bfab8332d5724eb2f59b5d27f3946fba67709b6c Mon Sep 17 00:00:00 2001 From: Fred Klassen Date: Sun, 4 Jun 2023 19:03:28 -0700 Subject: [PATCH 3/3] Clang-Format nits in mac.c --- src/common/mac.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/common/mac.c b/src/common/mac.c index be7ade9c..45e45fac 100644 --- a/src/common/mac.c +++ b/src/common/mac.c @@ -113,12 +113,12 @@ macinstring(const char *macstring, const u_char *mac) tempstr = strtok_r(ourstring, ",", &tok); if (tempstr != NULL && strlen(tempstr)) { - mac2hex(tempstr, tempmac, len); - if (memcmp(mac, tempmac, len) == 0) { - dbgx(3, "Packet matches: " MAC_FORMAT " sending out primary.\n", MAC_STR(tempmac)); - ret = TCPR_DIR_C2S; - goto EXIT_MACINSTRING; - } + mac2hex(tempstr, tempmac, len); + if (memcmp(mac, tempmac, len) == 0) { + dbgx(3, "Packet matches: " MAC_FORMAT " sending out primary.\n", MAC_STR(tempmac)); + ret = TCPR_DIR_C2S; + goto EXIT_MACINSTRING; + } } else { goto EXIT_MACINSTRING; }