Commit 9ea2aa8b authored Jan 04, 2015 by Pablo Neira Ayuso

netfilter: nfnetlink: validate nfnetlink header from batch



Make sure there is enough room for the nfnetlink header in the
netlink messages that are part of the batch. There is a similar
check in netlink_rcv_skb().

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 8ca3f5e9

net/netfilter/nfnetlink.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -321,7 +321,8 @@ replay:
		nlh = nlmsg_hdr(skb);
		err = 0;

		if (nlh->nlmsg_len < NLMSG_HDRLEN) {
		if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) \|\|
		skb->len < nlh->nlmsg_len) {
		err = -EINVAL;
		goto ack;
		}