From nobody@FreeBSD.org  Wed Feb 14 22:15:05 2001
Return-Path: <nobody@FreeBSD.org>
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id BA5FA37B4EC
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 14 Feb 2001 22:15:04 -0800 (PST)
Received: (from nobody@localhost)
	by freefall.freebsd.org (8.11.1/8.11.1) id f1F6F4r54139;
	Wed, 14 Feb 2001 22:15:04 -0800 (PST)
	(envelope-from nobody)
Message-Id: <200102150615.f1F6F4r54139@freefall.freebsd.org>
Date: Wed, 14 Feb 2001 22:15:04 -0800 (PST)
From: jcole@3lefties.com
To: freebsd-gnats-submit@FreeBSD.org
Subject: natd (and others?) segfault caused by error in libalias
X-Send-Pr-Version: www-1.0

>Number:         25107
>Category:       misc
>Synopsis:       natd (and others?) segfault caused by error in libalias
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    ru
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Feb 14 22:20:01 PST 2001
>Closed-Date:    Tue Feb 27 00:09:55 PST 2001
>Last-Modified:  Tue Feb 27 00:12:13 PST 2001
>Originator:     Jerimiah Cole
>Release:        4.1-RELEASE
>Organization:
I-NET of New Mexico
>Environment:
FreeBSD waldo.3lefties.com 4.1-RELEASE FreeBSD 4.1-RELEASE #0: Fri Nov  3 16:12:
21 MST 2000     root@waldo.3lefties.com:/usr/src/sys/compile/WALDO_JC-20001103
i386
>Description:
line 2622 of alias_db.c in libalias declares a varable to hold "The first firewall entry free for our use" when poking holes in the firewall for ftp data and irc dcc connections.  It's declared as int.  FreeBSD's ipfw firewall uses rule numbers up to 65535, so this variable should be declared as unsigned int.  When natd is set up to use this feature and the firewall "base" number is greater than 32767, natd happily segfaults when an ftp data connection is natted, and natd tries to generate the firewall hole.  I'm sure other software based on libalias is affected.
>How-To-Repeat:
Simply fire up natd with the -punch_fw basenumber:count option and the basenumber set greater than 32767 and try and establish an ftp data connection through the nat.
>Fix:
Change line 2622 of alias_db.c to read "unsigned int" instead of "int".  Note also that natd uses an unsigned int internally and when passing the base value to libalias routines.

>Release-Note:
>Audit-Trail:

From: Brian Somers <brian@Awfulhak.org>
To: jcole@3lefties.com
Cc: freebsd-gnats-submit@FreeBSD.ORG, brian@Awfulhak.org
Subject: Re: misc/25107: natd (and others?) segfault caused by error in libalias 
Date: Fri, 16 Feb 2001 00:42:40 +0000

 > >Number:         25107
 > >Category:       misc
 > >Synopsis:       natd (and others?) segfault caused by error in libalias
 [.....]
 > >Description:
 > line 2622 of alias_db.c in libalias declares a varable to hold "The first firewall entry free for our use" when poking holes in the firewall for ftp data and irc dcc connections.  It's declared as int.  FreeBSD's ipfw firewall uses rule numbers up to 65535, so this variable should be declared as unsigned int.  When natd is set up to use this feature and the firewall "base" number is greater than 32767, natd happily segfaults when an ftp data connection is natted, and natd tries to generate the firewall h ole.  I'm sure other software based on libalias is affected.
 
 I'm a little confused here.  An int is 32 bits - maxint is just above 
 2,000,000,000.  I don't understand what's wrapping at 32768...
 
 > >How-To-Repeat:
 > Simply fire up natd with the -punch_fw basenumber:count option and the basenumber set greater than 32767 and try and establish an ftp data connection through the nat.
 > >Fix:
 > Change line 2622 of alias_db.c to read "unsigned int" instead of "int".  Note also that natd uses an unsigned int internally and when passing the base value to libalias routines.
 
 This looks dangerous.  Just paging down the code a bit shows things 
 like fireWallNumNums and fileWallActiveNum should also probably be 
 unsigned.  This also implies that ``fwhole'' (local and in struct 
 tcp_dat) should be unsigned - but that breaks in at least one place 
 (namely the ``if (fwhole < 0)'' bit in ClearFWHole().
 
 I'm not saying that your suggestion is wrong, but that it looks a bit 
 dangerous to me :-/
 
 -- 
 Brian <brian@Awfulhak.org>                        <brian@[uk.]FreeBSD.org>
       <http://www.Awfulhak.org>                   <brian@[uk.]OpenBSD.org>
 Don't _EVER_ lose your sense of humour !
 
 
 
State-Changed-From-To: open->closed 
State-Changed-By: ru 
State-Changed-When: Tue Feb 27 00:09:55 PST 2001 
State-Changed-Why:  
This bug was fixed in 4.1-STABLE, libalias/alias_db.c,v 1.21.2.6. 
And it was a different reason. 


Responsible-Changed-From-To: freebsd-bugs->ru 
Responsible-Changed-By: ru 
Responsible-Changed-When: Tue Feb 27 00:09:55 PST 2001 
Responsible-Changed-Why:  
I am the maintainer of natd(8). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=25107 
>Unformatted:
