Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 44f9a2fd authored by Chuck Ebbert's avatar Chuck Ebbert Committed by David S. Miller
Browse files

[NETFILTER]: ebtables: don't compute gap before checking struct type 



We cannot compute the gap until we know we have a 'struct ebt_entry' and
not 'struct ebt_entries'.  Failure to check can cause crash.

Tested-by: default avatarSantiago Garcia Mantinan <manty@manty.net>
Acked-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarChuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent bbdc176a

net/bridge/netfilter/ebtables.c

+2 −1
Original line number Diff line number Diff line
@@ -610,7 +610,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo, 
	struct ebt_entry_target *t;

	struct ebt_target *target;

	unsigned int i, j, hook = 0, hookmask = 0;

	size_t gap = e->next_offset - e->target_offset;

	size_t gap;

	int ret;



	/* don't mess with the struct ebt_entries */
@@ -660,6 +660,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo, 
	if (ret != 0)

		goto cleanup_watchers;

	t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);

	gap = e->next_offset - e->target_offset;

	target = find_target_lock(t->u.name, &ret, &ebt_mutex);

	if (!target)

		goto cleanup_watchers;