diff options
author | Jan Engelhardt <jengelh@medozas.de> | 2010-03-16 16:49:21 +0100 |
---|---|---|
committer | Jan Engelhardt <jengelh@medozas.de> | 2010-03-16 17:54:26 +0100 |
commit | 21d1283750d9c4df7ca80165d2b9dc0b9bd214eb (patch) | |
tree | 6dd5e4f1cd7a0082ecc59e14fa411ebe73063668 /xtables.c | |
parent | 89b6c32f88be47e83c3f6e7f8fee812088cb8c22 (diff) |
iptables: correctly check for too-long chain/target/match names
* iptables-restore was not checking for chain name length
* iptables was not checking for match name length
* target length was checked against 32, not 29.
References: http://bugzilla.netfilter.org/show_bug.cgi?id=641
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Diffstat (limited to 'xtables.c')
-rw-r--r-- | xtables.c | 5 |
1 files changed, 5 insertions, 0 deletions
@@ -545,6 +545,11 @@ xtables_find_match(const char *name, enum xtables_tryload tryload, struct xtables_match *ptr; const char *icmp6 = "icmp6"; + if (strlen(name) > XT_FUNCTION_MAXNAMELEN - 1) + xtables_error(PARAMETER_PROBLEM, + "Invalid match name \"%s\" (%u chars max)", + name, XT_FUNCTION_MAXNAMELEN - 1); + /* This is ugly as hell. Nonetheless, there is no way of changing * this without hurting backwards compatibility */ if ( (strcmp(name,"icmpv6") == 0) || |