search for: param_buffer

http://bugzilla.netfilter.org/show_bug.cgi?id=774 Summary: iptables-restore can't parses the quoted parameter correctly. Product: iptables Version: unspecified Platform: All OS/Version: All Status: NEW Severity: normal Priority: P5 Component: iptables-restore AssignedTo:

...ree_argv() may crash if the overwritten pointer is either malformed or have duplicates in the newargv array. This pointer gets overwritten only when -t/--table option gets passed to do_command4() and we specifically check for this corner case: > iptables/iptables-restore.c:157 > if (!strncmp(param_buffer, "-t", 2) > || !strncmp(param_buffer, "--table", 8)) { > xtables_error(PARAMETER_PROBLEM, > "The -t option (seen in line %u) cannot be " > "used in iptables-restore.\n", line); > exit(1); > } Unfortunately, do_command4() uses getop...

...if (quote_open) { quote_open = 0; *curchar = ' '; @@ -325,6 +336,9 @@ || * curchar == '\n') { char param_buffer[1024]; int param_len = curchar-param_start; + + if (backquote_open) + continue; if (quote_open)...