From 6cd426bc7593ecf04a02c901d94e04093bdf69e4 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 8 Oct 2013 12:13:57 +0200 Subject: nft: fix bad length when comparing extension data area Use ->userspacesize to compare the extension data area, otherwise we also compare the internal private pointers which are only meaningful to the kernelspace. This fixes: xtables -4 -D INPUT -m connlimit \ --connlimit-above 10 --connlimit-mask 32 --connlimit-daddr But it also fixes many other matches/targets which use internal private data. Signed-off-by: Pablo Neira Ayuso --- iptables/nft-shared.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c index ebcb9692..3987f74b 100644 --- a/iptables/nft-shared.c +++ b/iptables/nft-shared.c @@ -683,7 +683,7 @@ compare_matches(struct xtables_rule_match *mt1, struct xtables_rule_match *mt2) } if (memcmp(m1->data, m2->data, - m1->u.user.match_size - sizeof(*m1)) != 0) { + mp1->match->userspacesize) != 0) { DEBUGP("mismatch match data\n"); return false; } @@ -709,10 +709,8 @@ bool compare_targets(struct xtables_target *tg1, struct xtables_target *tg2) if (strcmp(tg1->t->u.user.name, tg2->t->u.user.name) != 0) return false; - if (memcmp(tg1->t->data, tg2->t->data, - tg1->t->u.user.target_size - sizeof(*tg1->t)) != 0) { + if (memcmp(tg1->t->data, tg2->t->data, tg1->userspacesize) != 0) return false; - } return true; } -- cgit v1.2.3