diff options
| author | Florian Westphal <fw@strlen.de> | 2018-02-19 03:01:45 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-02-25 20:04:53 +0100 |
| commit | c4585a2823edf4d1326da44d1524ecbfda26bb37 (patch) | |
| tree | dd0673555c832ca71348c3753e4c2c9f3a5e4dc3 /include/sound/pxa2xx-lib.h | |
| parent | b078556aecd791b0e5cb3a59f4c3a14273b52121 (diff) | |
| download | linux-c4585a2823edf4d1326da44d1524ecbfda26bb37.tar.bz2 | |
netfilter: bridge: ebt_among: add missing match size checks
ebt_among is special, it has a dynamic match size and is exempt
from the central size checks.
Therefore it must check that the size of the match structure
provided from userspace is sane by making sure em->match_size
is at least the minimum size of the expected structure.
The module has such a check, but its only done after accessing
a structure that might be out of bounds.
tested with: ebtables -A INPUT ... \
--among-dst fe:fe:fe:fe:fe:fe
--among-dst fe:fe:fe:fe:fe:fe --among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fb,fe:fe:fe:fe:fc:fd,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe
--among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fa,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe,fe:fe:fe:fe:fe:fe
Reported-by: <syzbot+fe0b19af568972814355@syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/sound/pxa2xx-lib.h')
0 files changed, 0 insertions, 0 deletions