[4/5] netfilter: nf_tables: Check u32 load in u8 nft_immediate attribute
diff mbox

Message ID 13f03298fe8c42993a4a56c3a2fe70cc67bd6bd5.1470842571.git.nevola@gmail.com
State Changes Requested
Delegated to: Pablo Neira
Headers show

Commit Message

Laura Garcia Aug. 10, 2016, 3:31 p.m. UTC
Fix the direct assignment from u32 data input into the dlen attribute
with a size of u8.

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
---
 net/netfilter/nft_immediate.c | 3 +++
 1 file changed, 3 insertions(+)

Patch
diff mbox

diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index db3b746..6de590c 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -53,6 +53,9 @@  static int nft_immediate_init(const struct nft_ctx *ctx,
 			    tb[NFTA_IMMEDIATE_DATA]);
 	if (err < 0)
 		return err;
+
+	if (desc.len > U8_MAX)
+		return -EINVAL;
 	priv->dlen = desc.len;
 
 	priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]);