[PATCH nf-next 2/4] netfilter: xt_CT: check for nul-terminated timeout and helper name
Pablo Neira Ayuso <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
Otherwise, ignore malformed helper/timeout string that userspace
provides.
Fixes: 84f3bb9ae9db ("netfilter: xtables: add CT target")
Fixes: 24de58f46516 ("netfilter: xt_CT: allow to attach timeout policy + glue code")
Signed-off-by: Pablo Neira Ayuso <[email protected]>
---
net/netfilter/xt_CT.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index e78660dfdf4b..91326014ade1 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
goto err3;
}
- if (info->helper[0]) {
+ if (info->helper[0] &&
+ strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
ret = -ENAMETOOLONG;
goto err3;
@@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
goto err3;
}
- if (info->timeout[0]) {
+ if (info->timeout[0] &&
+ strnlen(info->timeout, sizeof(info->timeout)) < sizeof(info->timeout)) {
if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
ret = -ENAMETOOLONG;
goto err4;
--
2.47.3