mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-24 21:24:00 +08:00
netfilter: xt_RATEEST: reject non-null terminated string from userspace
syzbot reports:
detected buffer overflow in strlen
[..]
Call Trace:
strlen include/linux/string.h:325 [inline]
strlcpy include/linux/string.h:348 [inline]
xt_rateest_tg_checkentry+0x2a5/0x6b0 net/netfilter/xt_RATEEST.c:143
strlcpy assumes src is a c-string. Check info->name before its used.
Reported-by: syzbot+e86f7c428c8c50db65b4@syzkaller.appspotmail.com
Fixes: 5859034d7e
("[NETFILTER]: x_tables: add RATEEST target")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
1f45dc2206
commit
6cb56218ad
@ -115,6 +115,9 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
|
|||||||
} cfg;
|
} cfg;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
|
if (strnlen(info->name, sizeof(est->name)) >= sizeof(est->name))
|
||||||
|
return -ENAMETOOLONG;
|
||||||
|
|
||||||
net_get_random_once(&jhash_rnd, sizeof(jhash_rnd));
|
net_get_random_once(&jhash_rnd, sizeof(jhash_rnd));
|
||||||
|
|
||||||
mutex_lock(&xn->hash_lock);
|
mutex_lock(&xn->hash_lock);
|
||||||
|
Loading…
Reference in New Issue
Block a user