diff options
author | Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> | 2013-06-26 13:37:02 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-06-27 19:11:11 +0200 |
commit | 783a972f6acd680bed92fac36c5388d15620e754 (patch) | |
tree | 1a95b955f5f83f84711c9dec39cee2ac6d251308 /src/expr/bitwise.c | |
parent | 34caf0add23aab075c2bbe1a99927c081014cadd (diff) |
expr: xml: registers must be <= NFT_REG_MAX
With this patch, all expressions validate that registers are <= NFT_REG_MAX.
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/expr/bitwise.c')
-rw-r--r-- | src/expr/bitwise.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/src/expr/bitwise.c b/src/expr/bitwise.c index c8c4f40..80c4f20 100644 --- a/src/expr/bitwise.c +++ b/src/expr/bitwise.c @@ -237,6 +237,11 @@ nft_rule_expr_bitwise_xml_parse(struct nft_rule_expr *e, char *xml) return -1; } + if (tmp > NFT_REG_MAX) { + mxmlDelete(tree); + return -1; + } + bitwise->sreg = (uint32_t)tmp; e->flags |= (1 << NFT_EXPR_BITWISE_SREG); @@ -252,6 +257,11 @@ nft_rule_expr_bitwise_xml_parse(struct nft_rule_expr *e, char *xml) return -1; } + if (tmp > NFT_REG_MAX) { + mxmlDelete(tree); + return -1; + } + bitwise->dreg = (uint32_t)tmp; e->flags |= (1 << NFT_EXPR_BITWISE_DREG); |