summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2014-01-09 20:03:55 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2014-01-09 20:04:16 +0100
commitb38895c5773b00977ca6beff8ebbd2e3f55f1f84 (patch)
tree1e37bac72abf29ab1a3a14c427c3610939438876
parentc4ede3d3821a732120fd671846c2606a1eb4e8b3 (diff)
downloadop-kernel-dev-b38895c5773b00977ca6beff8ebbd2e3f55f1f84.zip
op-kernel-dev-b38895c5773b00977ca6beff8ebbd2e3f55f1f84.tar.gz
netfilter: nft_meta: fix lack of validation of the input register
We have to validate that the input register is in the range of allowed registers, otherwise we can take a incorrect register value as input that may lead us to a crash. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--net/netfilter/nft_meta.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index b43975a..e8254ad 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -239,6 +239,9 @@ static int nft_meta_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
return err;
priv->sreg = ntohl(nla_get_be32(tb[NFTA_META_SREG]));
+ err = nft_validate_input_register(priv->sreg);
+ if (err < 0)
+ return err;
return 0;
}
OpenPOWER on IntegriCloud