[PATCH nf-next 3/3] netfilter: ebtables: bound num_counters in do_update_counters()
Florian Westphal <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
sashiko says:
it appears the exact same
pattern remains unfixed in the sibling function do_update_counters().
Fixes: 43ae85af154b ("netfilter: ebtables: bound num_counters like nentries in do_replace()")
Signed-off-by: Florian Westphal <[email protected]>
---
net/bridge/netfilter/ebtables.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 7238e48d51a1..80008664ebe5 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1390,6 +1390,9 @@ static int do_update_counters(struct net *net, const char *name,
if (num_counters == 0)
return -EINVAL;
+ if (num_counters >= MAX_EBT_ENTRIES)
+ return -ENOMEM;
+
tmp = vmalloc_array(num_counters, sizeof(*tmp));
if (!tmp)
return -ENOMEM;
--
2.55.0