diff mbox

[conntrackd,1/8] conntrackd: fix sanitization of expection attribute in the wire format

Message ID 1439918919-6937-2-git-send-email-pablo@netfilter.org
State Accepted
Delegated to: Pablo Neira
Headers show

Commit Message

Pablo Neira Ayuso Aug. 18, 2015, 5:28 p.m. UTC 
The maximum number of attribute is NTA_EXP_MAX for expectation sync messages.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/parse.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox

Patch

diff --git a/src/parse.c b/src/parse.c
index f3ec6ac..878e354 100644
--- a/src/parse.c
+++ b/src/parse.c
@@ -510,7 +510,7 @@  int msg2exp(struct nf_expect *exp, struct nethdr *net, size_t remain)
 		ATTR_NETWORK2HOST(attr);
 		if (attr->nta_len > len)
 			goto err;
-		if (attr->nta_attr > NTA_MAX)
+		if (attr->nta_attr >= NTA_EXP_MAX)
 			goto err;
 		if (attr->nta_len < NTA_LENGTH(0))
 			goto err;