Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f0716cd6 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_compat: check match/targetinfo attr size 



We copy according to ->target|matchsize, so check that the netlink attribute
(which can include padding and might be larger) contains enough data.

Reported-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d387eaf5

net/netfilter/nft_compat.c

+6 −0
Original line number Diff line number Diff line
@@ -660,6 +660,9 @@ nft_match_select_ops(const struct nft_ctx *ctx, 
	if (IS_ERR(match))

		return ERR_PTR(-ENOENT);



	if (match->matchsize > nla_len(tb[NFTA_MATCH_INFO]))

		return ERR_PTR(-EINVAL);



	/* This is the first time we use this match, allocate operations */

	nft_match = kzalloc(sizeof(struct nft_xt), GFP_KERNEL);

	if (nft_match == NULL)
@@ -740,6 +743,9 @@ nft_target_select_ops(const struct nft_ctx *ctx, 
	if (IS_ERR(target))

		return ERR_PTR(-ENOENT);



	if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO]))

		return ERR_PTR(-EINVAL);



	/* This is the first time we use this target, allocate operations */

	nft_target = kzalloc(sizeof(struct nft_xt), GFP_KERNEL);

	if (nft_target == NULL)