ukanth/afwall — pull request #213 by cernekee (2013-10-27 19:47:23+00:00)
Title: iptables segfault on HTC One SV

The "hostname" argument to getaddrinfo() is allowed to be NULL:

```
int
getaddrinfo(const char *hostname, const char *servname,
const struct addrinfo *hints, struct addrinfo **res)
{
struct addrinfo sentinel;
struct addrinfo *cur;
int error = 0;
struct addrinfo ai;
struct addrinfo ai0;
struct addrinfo *pai;
const struct explore *ex;

/* hostname is allowed to be NULL */
/* servname is allowed to be NULL */
/* hints is allowed to be NULL */
assert(res != NULL);

memset(&sentinel, 0, sizeof(sentinel));
```

Stock iptables passes in a NULL hostname when it just wants to look up a port (service) number:

```
/**
* @name:	port name, or number as a string (e.g. "http" or "80")
*
* Resolve a port name to a number. Returns the port number in integral
* form on success, or <0 on error. (errno will not be set.)
*/
static int xtables_getportbyname(const char *name)
{
struct addrinfo *res = NULL, *p;
int ret;

ret = getaddrinfo(NULL, name, NULL, &res);
```

However, the fork of Bionic on the HTC One SV ROM, JB 4.1.2, erroneously calls strlen() on this argument without ensuring that it isn't NULL:

```
00033640 :
33640: e92d 4ff0 stmdb sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
33644: b0e9 sub sp, #420
33646: 4617 mov r7, r2 ; r7 = hints
33648: 4688 mov r8, r1 ; r8 = servname
3364a: 9309 str r3, [sp, #36] ; sp+36 = res
3364c: 4605 mov r5, r0 ; r5 = hostname
3364e: f8df 3864 ldr.w r3, [pc, #2148]
33652: 9909 ldr r1, [sp, #36]
33654: 447b add r3, pc
33656: 681b ldr r3, [r3, #0]
33658: 930c str r3, [sp, #48]
3365a: 681a ldr r2, [r3, #0]
3365c: 9267 str r2, [sp, #412]
3365e: b931 cbnz r1, 3366e ; taken if res != NULL (true in this case)

[snip]

3366e: f7e3 ee8c blx 17388 ; strlen(hostname)
```

This causes a segfault when AFWall tries to add a rule involving a port number, e.g.

```
iptables -A OUTPUT -p udp --dport 53 -j RETURN
```

We can work around this by passing in a dummy hostname from our builtin iptables binary. (The system iptables binary will still crash, so it can't be used on a device with this bug.)

Note that this pull request includes a couple of other fixes too, for Travis builds and for the Bug #212.