utils: fix invalid memory access in fw3_bitlen2netmask()

When fw3_bitlen2netmask() is invoked with a bit length of 128, the next
byte after the end of struct in6_addr is errorneously zeroed, leading to
a heap corruption on at least x86_64 with uclibc and possibly others.

Prevent the invalid writes by explicitely testing for a bit count < 128.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

diff --git a/utils.c b/utils.c
index cb478bb81c7a95eb97f9650bbb6f541ec32194e0..756633a7412c49a338b25507207a32f052dd5a36 100644 (file)
--- a/utils.c
+++ b/utils.c
@@ -786,8 +786,12 @@ fw3_bitlen2netmask(int family, int bits, void *mask)
                i = abs(bits);
 
                memset(v6->s6_addr, 0xff, i / 8);
-               memset(v6->s6_addr + (i / 8) + 1, 0, (128 - i) / 8);
-               v6->s6_addr[i / 8] = 0xff << (8 - (i & 7));
+
+               if (i < 128)
+               {
+                       memset(v6->s6_addr + (i / 8) + 1, 0, (128 - i) / 8);
+                       v6->s6_addr[i / 8] = 0xff << (8 - (i & 7));
+               }
 
                if (bits < 0)
                        for (i = 0; i < 16; i++)