Permalink
Browse files

netfilter: x_tables: check for size overflow

Ben Hawkes says:
 integer overflow in xt_alloc_table_info, which on 32-bit systems can
 lead to small structure allocation and a copy_from_user based heap
 corruption.

Change-Id: I13c554c630651a37e3f6a195e9a5f40cddcb29a1
Reported-by: Ben Hawkes <hawkes@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information...
Florian Westphal authored and andi34 committed Mar 10, 2016
1 parent 81e5f70 commit 1064351fd78269a91b89cc0aa7c989b7976365a5
Showing with 4 additions and 0 deletions.
  1. +4 −0 net/netfilter/x_tables.c
View
@@ -663,6 +663,10 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
{
struct xt_table_info *newinfo;
int cpu;
size_t sz = sizeof(*newinfo) + size;
if (sz < sizeof(*newinfo))
return NULL;
/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)

0 comments on commit 1064351

Please sign in to comment.