diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-11-18 09:55:17 +0100 |
|---|---|---|
| committer | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2014-11-18 09:55:17 +0100 |
| commit | aeb28678e69ab156800bc8b6be47a29896396e84 (patch) | |
| tree | 06414055fbbd832be314905b325396932ed83c28 /kernel/net/netfilter/ipset | |
| parent | 14268dd62ed9067b687543d586d82501aa3e6fb7 (diff) | |
netfilter: ipset: small potential read beyond the end of buffer
We could be reading 8 bytes into a 4 byte buffer here. It seems
harmless but adding a check is the right thing to do and it silences a
static checker warning.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'kernel/net/netfilter/ipset')
| -rw-r--r-- | kernel/net/netfilter/ipset/ip_set_core.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/kernel/net/netfilter/ipset/ip_set_core.c b/kernel/net/netfilter/ipset/ip_set_core.c index 872f71e..c2f4b17 100644 --- a/kernel/net/netfilter/ipset/ip_set_core.c +++ b/kernel/net/netfilter/ipset/ip_set_core.c @@ -1892,6 +1892,11 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) /* Check the version at the beginning of operations */ struct ip_set_req_version *req_version = data; + if (*len < sizeof(struct ip_set_req_version)) { + ret = -EINVAL; + goto done; + } + if (req_version->version != IPSET_PROTOCOL) { ret = -EPROTO; goto done; |