Message ID | CAM_iQpW3F=inR0y6GFE64OgkhKSdzF-trrZamgThXTiyOYYmBw@mail.gmail.com |
---|---|
State | RFC, archived |
Delegated to: | David Miller |
Headers | show |
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index ac78024..4a0ec8f 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -1503,6 +1503,10 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) if (copy_from_user(&tmp, user, sizeof(tmp))) return -EFAULT; + if (memscan(tmp.name, '\0', EBT_TABLE_MAXNAMELEN) == + (tmp.name + EBT_TABLE_MAXNAMELEN)) + return -EINVAL; + t = find_table_lock(net, tmp.name, &ret, &ebt_mutex); if (!t)