kern/73276: ipfw2 vulnerability (parser error)

[Jon Simola]

On 5/10/05, Tilman Linneweh <arved at freebsd.org> wrote:
> Synopsis: ipfw2 vulnerability (parser error)
> 
> Responsible-Changed-From-To: freebsd-bugs->freebsd-ipfw
> Responsible-Changed-By: arved
> Responsible-Changed-When: Tue May 10 13:50:30 GMT 2005
> Responsible-Changed-Why:
> Over to ipfw mailinglist
> 
> http://www.freebsd.org/cgi/query-pr.cgi?pr=73276

More accurately, anything after the closing '}' is ignored by the
parser. I'm pretty sure this fixes that.

--- ipfw2.c.orig        Tue May 10 08:45:12 2005
+++ ipfw2.c     Tue May 10 09:53:08 2005
@@ -2088,8 +2088,11 @@
                        i = -1;
                        if (*s == '-')
                            i = a;
-                       else if (*s == '}')
+                       else if (*s == '}') {
+                           if (strlen(s) > 1)
+                               errx(EX_DATAERR, "trailing garbage after '}'");
                            break;
+                       }
                        av = s+1;
                }
                return;



-- 
Jon Simola
Systems Administrator
ABC Communications