netfilter: x_tables: make sure e->next_offset covers remaining blob size
Otherwise this function may read data beyond the ruleset blob. Change-Id: Idcfb2fffba72618a5fda1c6cc94394ed4f79be93 Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git Git-commit: 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91 Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
This commit is contained in:
parent
e97b6a0e02
commit
f6bbb089fe
3 changed files with 12 additions and 6 deletions
|
@ -578,7 +578,8 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
|
|||
unsigned int h;
|
||||
|
||||
if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
|
||||
(unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
|
||||
(unsigned char *)e + sizeof(struct arpt_entry) >= limit ||
|
||||
(unsigned char *)e + e->next_offset > limit) {
|
||||
duprintf("Bad offset %p\n", e);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
@ -1233,7 +1234,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
|
|||
|
||||
duprintf("check_compat_entry_size_and_hooks %p\n", e);
|
||||
if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||
|
||||
(unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
|
||||
(unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit ||
|
||||
(unsigned char *)e + e->next_offset > limit) {
|
||||
duprintf("Bad offset %p, limit = %p\n", e, limit);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
|
|
@ -743,7 +743,8 @@ check_entry_size_and_hooks(struct ipt_entry *e,
|
|||
unsigned int h;
|
||||
|
||||
if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
|
||||
(unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
|
||||
(unsigned char *)e + sizeof(struct ipt_entry) >= limit ||
|
||||
(unsigned char *)e + e->next_offset > limit) {
|
||||
duprintf("Bad offset %p\n", e);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
@ -1493,7 +1494,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
|
|||
|
||||
duprintf("check_compat_entry_size_and_hooks %p\n", e);
|
||||
if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
|
||||
(unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
|
||||
(unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit ||
|
||||
(unsigned char *)e + e->next_offset > limit) {
|
||||
duprintf("Bad offset %p, limit = %p\n", e, limit);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
|
|
@ -755,7 +755,8 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
|
|||
unsigned int h;
|
||||
|
||||
if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
|
||||
(unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
|
||||
(unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
|
||||
(unsigned char *)e + e->next_offset > limit) {
|
||||
duprintf("Bad offset %p\n", e);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
@ -1505,7 +1506,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
|
|||
|
||||
duprintf("check_compat_entry_size_and_hooks %p\n", e);
|
||||
if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
|
||||
(unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
|
||||
(unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
|
||||
(unsigned char *)e + e->next_offset > limit) {
|
||||
duprintf("Bad offset %p, limit = %p\n", e, limit);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
|
Loading…
Add table
Reference in a new issue