Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1b05756c authored by Jozsef Kadlecsik's avatar Jozsef Kadlecsik
Browse files

netfilter: ipset: Fix warn: integer overflows 'sizeof(*map) + size * set->dsize' 



Dan Carpenter reported that the static checker emits the warning

        net/netfilter/ipset/ip_set_list_set.c:600 init_list_set()
        warn: integer overflows 'sizeof(*map) + size * set->dsize'

Limit the maximal number of elements in list type of sets.

Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
parent 94729f8a

include/linux/netfilter/ipset/ip_set_list.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -6,5 +6,6 @@ 




#define IP_SET_LIST_DEFAULT_SIZE	8

#define IP_SET_LIST_DEFAULT_SIZE	8

#define IP_SET_LIST_MIN_SIZE		4

#define IP_SET_LIST_MIN_SIZE		4

#define IP_SET_LIST_MAX_SIZE		65536





#endif /* __IP_SET_LIST_H */
 
#endif /* __IP_SET_LIST_H */

net/netfilter/ipset/ip_set_list_set.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -597,7 +597,9 @@ init_list_set(struct net *net, struct ip_set *set, u32 size) 
	struct set_elem *e;

	struct set_elem *e;

	u32 i;

	u32 i;





	map = kzalloc(sizeof(*map) + size * set->dsize, GFP_KERNEL);

	map = kzalloc(sizeof(*map) +

		      min_t(u32, size, IP_SET_LIST_MAX_SIZE) * set->dsize,

		      GFP_KERNEL);

	if (!map)

	if (!map)

		return false;

		return false;