>Number:         25532
>Category:       bin
>Synopsis:       bad icmp-type rule in /etc/ipf.conf can cause ipf to segv upon parsing
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue May 11 01:43:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Geoff C. Wing
>Release:        NetBSD 2.0E  2004-05-10
>Organization:
>Environment:
System: NetBSD g.primenet.com.au 2.0E NetBSD 2.0E (G) #0: Mon May 10 13:32:46 EST 2004 gcw@g.primenet.com.au:/usr/netbsd/src/sys/arch/i386/compile/G i386
Architecture: i386
Machine: i386
>Description:
	A malformed icmp-type rule can cause ipf to segfault upon parsing.
	
	Minimal version:
	pass  in quick proto icmp all head 1
	block in all icmp-type echo group 1

	Obviously, "all" should be "from any to any ..."

#0  0x08050fd0 in ipf_yyparse () at ipf_y.y:901
901             { DOALL(fr->fr_icmp = htons($2 << 8); fr->fr_icmpm = htons(0xff00);) }
(gdb) bt
#0  0x08050fd0 in ipf_yyparse () at ipf_y.y:901
#1  0x0804d9c1 in ipf_parsesome (fd=4, addfunc=0x804982a <ipf_interceptadd>, 
    iocfuncs=0x8065140, fp=0x4812b560) at ipf_y.y:1513
#2  0x0804d896 in ipf_parsefile (fd=4, addfunc=0x804982a <ipf_interceptadd>, 
    iocfuncs=0x8065140, filename=0xbfbfebec "/etc/ipf.conf") at ipf_y.y:1475
#3  0x080497f2 in procfile (name=0xbfbfebdc "/sbin/ipf", 
    file=0xbfbfebec "/etc/ipf.conf")
    at /usr/netbsd/src/dist/ipf/tools/ipf.c:234
#4  0x080494c6 in main (argc=4, argv=0xbfbfeacc)
    at /usr/netbsd/src/dist/ipf/tools/ipf.c:107
#5  0x08049152 in ___start ()

>How-To-Repeat:
	see above
>Fix:
	?
>Release-Note:
>Audit-Trail:
>Unformatted: