Commit 7266a6b0 authored Jan 04, 2015 by Pablo Neira Ayuso Committed by Greg Kroah-Hartman Jan 29, 2015

netfilter: nfnetlink: validate nfnetlink header from batch



commit 9ea2aa8b7dba9e99544c4187cc298face254569f upstream.

Make sure there is enough room for the nfnetlink header in the
netlink messages that are part of the batch. There is a similar
check in netlink_rcv_skb().

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 513c6682

net/netfilter/nfnetlink.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -321,7 +321,8 @@ replay:
		nlh = nlmsg_hdr(skb);
		err = 0;

		if (nlh->nlmsg_len < NLMSG_HDRLEN) {
		if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) \|\|
		skb->len < nlh->nlmsg_len) {
		err = -EINVAL;
		goto ack;
		}