Skip to content

Commit 6cb5621

Browse files
Florian Westphalummakynes
authored andcommitted
netfilter: xt_RATEEST: reject non-null terminated string from userspace
syzbot reports: detected buffer overflow in strlen [..] Call Trace: strlen include/linux/string.h:325 [inline] strlcpy include/linux/string.h:348 [inline] xt_rateest_tg_checkentry+0x2a5/0x6b0 net/netfilter/xt_RATEEST.c:143 strlcpy assumes src is a c-string. Check info->name before its used. Reported-by: syzbot+e86f7c428c8c50db65b4@syzkaller.appspotmail.com Fixes: 5859034 ("[NETFILTER]: x_tables: add RATEEST target") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
1 parent 1f45dc2 commit 6cb5621

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

net/netfilter/xt_RATEEST.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,9 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
115115
} cfg;
116116
int ret;
117117

118+
if (strnlen(info->name, sizeof(est->name)) >= sizeof(est->name))
119+
return -ENAMETOOLONG;
120+
118121
net_get_random_once(&jhash_rnd, sizeof(jhash_rnd));
119122

120123
mutex_lock(&xn->hash_lock);

0 commit comments

Comments
 (0)