Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e27bf5d5 authored by Florian Westphal's avatar Florian Westphal Committed by Greg Kroah-Hartman
Browse files

netfilter: xt_RATEEST: reject non-null terminated string from userspace 



commit 6cb56218ad9e580e519dcd23bfb3db08d8692e5a upstream.

syzbot reports:
detected buffer overflow in strlen
[..]
Call Trace:
 strlen include/linux/string.h:325 [inline]
 strlcpy include/linux/string.h:348 [inline]
 xt_rateest_tg_checkentry+0x2a5/0x6b0 net/netfilter/xt_RATEEST.c:143

strlcpy assumes src is a c-string. Check info->name before its used.

Reported-by: default avatar <syzbot+e86f7c428c8c50db65b4@syzkaller.appspotmail.com>
Fixes: 5859034d ("[NETFILTER]: x_tables: add RATEEST target")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0a4feb89

net/netfilter/xt_RATEEST.c

+3 −0
Original line number Diff line number Diff line
@@ -106,6 +106,9 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par) 
	} cfg;

	int ret;



	if (strnlen(info->name, sizeof(est->name)) >= sizeof(est->name))

		return -ENAMETOOLONG;



	net_get_random_once(&jhash_rnd, sizeof(jhash_rnd));



	mutex_lock(&xt_rateest_mutex);