mirrors/passt
1
0
Fork 0
mirror of https://passt.top/passt synced 2025-06-18 05:05:33 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix widespread off-by-one error dealing with port numbers

Browse source 
Port numbers (for both TCP and UDP) are 16-bit, and so fit exactly into a
'short'.  USHRT_MAX is therefore the maximum port number and this is widely
used in the code.  Unfortunately, a lot of those places don't actually
want the maximum port number (USHRT_MAX == 65535), they want the total
number of ports (65536).  This leads to a number of potentially nasty
consequences:

 * We have buffer overruns on the port_fwd::delta array if we try to use
   port 65535
 * We have similar potential overruns for the tcp_sock_* arrays
 * Interestingly udp_act had the correct size, but we can calculate it in
   a more direct manner
 * We have a logical overrun of the ports bitmap as well, although it will
   just use an unused bit in the last byte so isnt harmful
 * Many loops don't consider port 65535 (which does mitigate some but not
   all of the buffer overruns above)
 * In udp_invert_portmap() we incorrectly compute the reverse port
   translation for return packets

Correct all these by using a new NUM_PORTS defined explicitly for this
purpose.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
This commit is contained in:
David Gibson 2022-09-24 19:08:22 +10:00 • committed by Stefano Brivio
parent 3ede07aac9
commit d5b80ccc72
5 changed files with 19 additions and 16 deletions

4
conf.c
View file

@ -209,7 +209,7 @@ static int conf_ports(const struct ctx *c, char optname, const char *optarg,
if (sep == p)
break;
if (port > USHRT_MAX || errno)
if (port >= NUM_PORTS || errno)
goto bad;
switch (*sep) {
@ -276,7 +276,7 @@ static int conf_ports(const struct ctx *c, char optname, const char *optarg,
if (sep == p)
break;
if (port > USHRT_MAX || errno)
if (port >= NUM_PORTS || errno)
goto bad;
/* -p 22