mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 21:57:43 +00:00
netfilter: ebtables: abort if next_offset is too small
next_offset must be > 0, otherwise this loops forever. The offset also contains the size of the ebt_entry structure itself, so anything smaller is invalid. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
parent
ef00f89f1e
commit
1756de262e
1 changed files with 2 additions and 0 deletions
|
@ -444,6 +444,8 @@ static int ebt_verify_pointers(const struct ebt_replace *repl,
|
||||||
break;
|
break;
|
||||||
if (left < e->next_offset)
|
if (left < e->next_offset)
|
||||||
break;
|
break;
|
||||||
|
if (e->next_offset < sizeof(struct ebt_entry))
|
||||||
|
return -EINVAL;
|
||||||
offset += e->next_offset;
|
offset += e->next_offset;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue