Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c08522e authored by Tim Gardner's avatar Tim Gardner Committed by Patrick McHardy
Browse files

netfilter: xt_recent: fix buffer overflow 



e->index overflows e->stamps[] every ip_pkt_list_tot packets.

Consider the case when ip_pkt_list_tot==1; the first packet received is stored
in e->stamps[0] and e->index is initialized to 1. The next received packet
timestamp is then stored at e->stamps[1] in recent_entry_update(),
a buffer overflow because the maximum e->stamps[] index is 0.

Signed-off-by: default avatarTim Gardner <tim.gardner@canonical.com>
Cc: stable@kernel.org
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 9e2dcf72

net/netfilter/xt_recent.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -177,10 +177,10 @@ recent_entry_init(struct recent_table *t, const union nf_inet_addr *addr, 




static void recent_entry_update(struct recent_table *t, struct recent_entry *e)

static void recent_entry_update(struct recent_table *t, struct recent_entry *e)

{

{

	e->index %= ip_pkt_list_tot;

	e->stamps[e->index++] = jiffies;

	e->stamps[e->index++] = jiffies;

	if (e->index > e->nstamps)

	if (e->index > e->nstamps)

		e->nstamps = e->index;

		e->nstamps = e->index;

	e->index %= ip_pkt_list_tot;

	list_move_tail(&e->lru_list, &t->lru_list);

	list_move_tail(&e->lru_list, &t->lru_list);

}

}