netfilter: x_tables: check for size overflow
Ben Hawkes says: integer overflow in xt_alloc_table_info, which on 32-bit systems can lead to small structure allocation and a copy_from_user based heap corruption. Reported-by: Ben Hawkes <hawkes@google.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
f0716cd6eb
commit
d157bd7615
|
@ -659,6 +659,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
|
|||
struct xt_table_info *info = NULL;
|
||||
size_t sz = sizeof(*info) + size;
|
||||
|
||||
if (sz < sizeof(*info))
|
||||
return NULL;
|
||||
|
||||
/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
|
||||
if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
|
||||
return NULL;
|
||||
|
|
Loading…
Reference in New Issue