From aeb28678e69ab156800bc8b6be47a29896396e84 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 18 Nov 2014 09:55:17 +0100 Subject: netfilter: ipset: small potential read beyond the end of buffer We could be reading 8 bytes into a 4 byte buffer here. It seems harmless but adding a check is the right thing to do and it silences a static checker warning. Signed-off-by: Dan Carpenter Acked-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso --- kernel/net/netfilter/ipset/ip_set_core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/net/netfilter/ipset/ip_set_core.c b/kernel/net/netfilter/ipset/ip_set_core.c index 872f71e..c2f4b17 100644 --- a/kernel/net/netfilter/ipset/ip_set_core.c +++ b/kernel/net/netfilter/ipset/ip_set_core.c @@ -1892,6 +1892,11 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) /* Check the version at the beginning of operations */ struct ip_set_req_version *req_version = data; + if (*len < sizeof(struct ip_set_req_version)) { + ret = -EINVAL; + goto done; + } + if (req_version->version != IPSET_PROTOCOL) { ret = -EPROTO; goto done; -- cgit v1.2.3