korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-04 17:44:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: ebtables: abort if next_offset is too small

Browse Source 
next_offset must be > 0, otherwise this loops forever.
The offset also contains the size of the ebt_entry structure
itself, so anything smaller is invalid.

Signed-off-by: Florian Westphal <fwestphal@astaro.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Florian Westphal 2010-02-15 18:15:55 +01:00 committed by Patrick McHardy
parent ef00f89f1e
commit 1756de262e
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/bridge/netfilter/ebtables.c
View File

@ -444,6 +444,8 @@ static int ebt_verify_pointers(const struct ebt_replace *repl,
break;
if (left < e->next_offset)
break;
if (e->next_offset < sizeof(struct ebt_entry))
return -EINVAL;
offset += e->next_offset;
}
}