bin/65961: ipfw2 memory corruption inside add()

[Eugene Grosbein]

>Number:         65961
>Category:       bin
>Synopsis:       ipfw2 memory corruption inside add()
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Apr 25 09:10:19 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Eugene Grosbein
>Release:        FreeBSD 4.10-PRERELEASE i386
>Organization:
Svyaz Service JSC
>Environment:
System: FreeBSD grosbein.pp.ru 4.10-PRERELEASE FreeBSD 4.10-PRERELEASE #1: Sun Apr 25 13:29:39 KRAST 2004 eu at grosbein.pp.ru:/usr/local/obj/usr/local/src/sys/DADV i386

>Description:
	ipfw2 supports or-blocks that may have variable length.
	A function add() in ipfw2.c uses fixed-length arrays
	and does not check for overflows. Hence, memory structure corruption
	occurs while very long or-block is passed from a command line.

	This results in segmentation faults or even enless loops
	when ipfw2 eats all available CPU cycles.

>How-To-Repeat:

	The next script takes a number (n) and creates syntactical correct
	'ipfw add' rule with or-block containing of n+1 IP address.

#!/bin/sh

args="add 60001 count ip from any to { "

for i in `jot $1 1`
do
  args="${args}127.0.0.$i or "
done
args="${args}127.0.1.1 }";

ipfw delete 60001
echo ipfw $args
ipfw $args

	"./test 121" works.
	"./test 123" leads to corruption of actbuf[] and th cycle
	does not finish because variable i gets zero value:

        /*
         * copy all other actions
         */
        for (src = (ipfw_insn *)actbuf; src != action; src += i) {
                i = F_LEN(src);
                bcopy(src, dst, i * sizeof(uint32_t));
                dst += i;
        }

	"./test 500" leads to segmentation fault inside exit():

Core was generated by 	pfw'.
Program terminated with signal 11, Segmentation fault.
#0  0x8072648 in exit ()
(gdb) bt
#0  0x8072648 in exit ()
#1  0x8054970 in warn ()
#2  0x80548de in errx ()
#3  0x804bda0 in fill_ip (cmd=0x808d098, av=0x809e0f0 "127.0.0.256")
    at /usr/local/src/sbin/ipfw/ipfw2.c:1932
#4  0x804da76 in add_dstip (cmd=0x808d098, av=0x809e0f0 "127.0.0.256")
    at /usr/local/src/sbin/ipfw/ipfw2.c:2669
#5  0x804e90e in add (ac=492, av=0x809b818)
    at /usr/local/src/sbin/ipfw/ipfw2.c:3052
#6  0x80505ba in ipfw_main (oldac=1010, oldav=0xbfbfcea4)
    at /usr/local/src/sbin/ipfw/ipfw2.c:3793
#7  0x8050eb4 in main (ac=1011, av=0xbfbfcea0)
    at /usr/local/src/sbin/ipfw/ipfw2.c:3966

>Fix:

	Document limits of or-block length and implement sanity checks.

Eugene Grosbein
>Release-Note:
>Audit-Trail:
>Unformatted: