joel16/android_kernel_sony_msm8994
1
0
Fork 0
mirror of https://github.com/joel16/android_kernel_sony_msm8994.git synced 2024-11-23 12:10:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

netfilter: x_tables: check for size overflow

Browse Source 
Ben Hawkes says:
 integer overflow in xt_alloc_table_info, which on 32-bit systems can
 lead to small structure allocation and a copy_from_user based heap
 corruption.

Change-Id: I0315b595eaa263166a815fc9d5648bc0433f150e
Reported-by: Ben Hawkes <hawkes@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2016-03-10 01:56:23 +01:00 committed by Olivier Karasangabo
parent 76ce7a779b
commit 535d628ed0
No known key found for this signature in database
GPG Key ID: C5C93AF8ED1CCEB5
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/netfilter/x_tables.c
View File

@ -677,6 +677,10 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
{
struct xt_table_info *newinfo;
int cpu;
size_t sz = sizeof(*newinfo) + size;
if (sz < sizeof(*newinfo))
return NULL;
/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)