diff options
| author | Florian Westphal <fw@strlen.de> | 2016-04-01 14:17:28 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-06-24 10:15:30 -0700 |
| commit | f216289025f02e99628d6783f251f3a9d1966cad (patch) | |
| tree | a1ceb9d621543f48c99a663b52d87e9899e3aea6 /net/batman-adv/distributed-arp-table.c | |
| parent | 4a3285cb417e2a55899efd6a87214c71b7e78f68 (diff) | |
| download | lwn-f216289025f02e99628d6783f251f3a9d1966cad.tar.gz lwn-f216289025f02e99628d6783f251f3a9d1966cad.zip | |
netfilter: x_tables: check for bogus target offset
commit ce683e5f9d045e5d67d1312a42b359cb2ab2a13c upstream.
We're currently asserting that targetoff + targetsize <= nextoff.
Extend it to also check that targetoff is >= sizeof(xt_entry).
Since this is generic code, add an argument pointing to the start of the
match/target, we can then derive the base structure size from the delta.
We also need the e->elems pointer in a followup change to validate matches.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/batman-adv/distributed-arp-table.c')
0 files changed, 0 insertions, 0 deletions