Commit 113ec644 authored by Florian Westphal's avatar Florian Westphal Committed by Ben Hutchings

netfilter: x_tables: make sure e->next_offset covers remaining blob size

commit 6e94e0cf upstream.

Otherwise this function may read data beyond the ruleset blob.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent dc385be2
...@@ -563,7 +563,8 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e, ...@@ -563,7 +563,8 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
int err; int err;
if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 || if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
(unsigned char *)e + sizeof(struct arpt_entry) >= limit) { (unsigned char *)e + sizeof(struct arpt_entry) >= limit ||
(unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p\n", e); duprintf("Bad offset %p\n", e);
return -EINVAL; return -EINVAL;
} }
...@@ -1223,7 +1224,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e, ...@@ -1223,7 +1224,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
duprintf("check_compat_entry_size_and_hooks %p\n", e); duprintf("check_compat_entry_size_and_hooks %p\n", e);
if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 || if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||
(unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) { (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit ||
(unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p, limit = %p\n", e, limit); duprintf("Bad offset %p, limit = %p\n", e, limit);
return -EINVAL; return -EINVAL;
} }
......
...@@ -726,7 +726,8 @@ check_entry_size_and_hooks(struct ipt_entry *e, ...@@ -726,7 +726,8 @@ check_entry_size_and_hooks(struct ipt_entry *e,
int err; int err;
if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 || if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
(unsigned char *)e + sizeof(struct ipt_entry) >= limit) { (unsigned char *)e + sizeof(struct ipt_entry) >= limit ||
(unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p\n", e); duprintf("Bad offset %p\n", e);
return -EINVAL; return -EINVAL;
} }
...@@ -1489,7 +1490,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, ...@@ -1489,7 +1490,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
duprintf("check_compat_entry_size_and_hooks %p\n", e); duprintf("check_compat_entry_size_and_hooks %p\n", e);
if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 || if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
(unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) { (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit ||
(unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p, limit = %p\n", e, limit); duprintf("Bad offset %p, limit = %p\n", e, limit);
return -EINVAL; return -EINVAL;
} }
......
...@@ -737,7 +737,8 @@ check_entry_size_and_hooks(struct ip6t_entry *e, ...@@ -737,7 +737,8 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
int err; int err;
if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 || if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
(unsigned char *)e + sizeof(struct ip6t_entry) >= limit) { (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
(unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p\n", e); duprintf("Bad offset %p\n", e);
return -EINVAL; return -EINVAL;
} }
...@@ -1501,7 +1502,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, ...@@ -1501,7 +1502,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
duprintf("check_compat_entry_size_and_hooks %p\n", e); duprintf("check_compat_entry_size_and_hooks %p\n", e);
if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 || if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
(unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) { (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
(unsigned char *)e + e->next_offset > limit) {
duprintf("Bad offset %p, limit = %p\n", e, limit); duprintf("Bad offset %p, limit = %p\n", e, limit);
return -EINVAL; return -EINVAL;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment