diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2015-06-05 22:25:01 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2015-06-05 22:25:01 +0200 |
| commit | 9f61f62544747db5d5c590bfae9dd19f1337e421 (patch) | |
| tree | 74772cccd14e7ab6d01a3452d4030cd7f8e58ccb /net/bridge/netfilter/ebtables.c | |
| parent | de8d1810fda5463ee60ba2937ca68e55a52bd9e7 (diff) | |
| parent | 086e8ddb567951513a5dace21a09297768aee14f (diff) | |
| download | linux-9f61f62544747db5d5c590bfae9dd19f1337e421.tar.bz2 | |
Merge branch 'linus' into irq/core
Get the urgent fixes from upstream to avoid conflicts.
Diffstat (limited to 'net/bridge/netfilter/ebtables.c')
| -rw-r--r-- | net/bridge/netfilter/ebtables.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index 91180a7fc943..24c7c96bf5f8 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -1117,6 +1117,8 @@ static int do_replace(struct net *net, const void __user *user, return -ENOMEM; if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) return -ENOMEM; + if (tmp.num_counters == 0) + return -EINVAL; tmp.name[sizeof(tmp.name) - 1] = 0; @@ -2159,6 +2161,8 @@ static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl, return -ENOMEM; if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) return -ENOMEM; + if (tmp.num_counters == 0) + return -EINVAL; memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry)); |