Skip to contentSkip to conversation

netfilter: nf_tables: Add size check on u8 nft_exthdr attributes

PATCH Applied Laura Garcia Liebana 2 participants 4 messages Aug 9, 2016 – Aug 10, 2016

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Laura Garcia Liebana

author
#0 lore raw

PATCH 1/1 netfilter: nf_tables: Add size check on u8 nft_exthdr attributes

Fix the direct assignment of offset and length attributes included in nft_exthdr structure from u32 data to u8.

Signed-off-by Laura Garcia Liebana <[email protected]>
---
 net/netfilter/nft_exthdr.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)
net/netfilter/nft_exthdr.c +11 -2
index ba7aed1..dec3c36 100644
@@ -59,6 +59,7 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
 			   const struct nlattr * const tb[])
 {
 	struct nft_exthdr *priv = nft_expr_priv(expr);
+	u32 offset, len;
 
 	if (tb[NFTA_EXTHDR_DREG] == NULL ||
 	    tb[NFTA_EXTHDR_TYPE] == NULL ||

@@ -67,8 +68,16 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
 		return -EINVAL;
 
 	priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
-	priv->offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
-	priv->len    = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+
+	offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
+	len    = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+
+	if (offset > U8_MAX || len > U8_MAX)
+		return -EINVAL;
+
+	priv->offset = offset;
+	priv->len = len;
+
 	priv->dreg   = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
 
 	return nft_validate_register_store(ctx, priv->dreg, NULL,
Signature · 1 line
2.8.1
maintainer Applied
#1 lore raw
Quoted 2 lines · Laura Garcia Liebana

Fix the direct assignment of offset and length attributes included in nft_exthdr structure from u32 data to u8.

Applied to my nf tree, I just made a minor edition on this patch.

Thanks.

maintainer
#2 lore raw
Quoted 5 lines · Pablo Neira Ayuso
Quoted 2 lines · Laura Garcia Liebana

Fix the direct assignment of offset and length attributes included in nft_exthdr structure from u32 data to u8.

Applied to my nf tree, I just made a minor edition on this patch.

It would be good to search for similar issues in other existing expressions, BTW. Let me know if you can take care of it. Thanks.

author
#3 lore raw
Quoted 9 lines · Pablo Neira Ayuso
Quoted 5 lines · Pablo Neira Ayuso
Quoted 2 lines · Laura Garcia Liebana

Fix the direct assignment of offset and length attributes included in nft_exthdr structure from u32 data to u8.

Applied to my nf tree, I just made a minor edition on this patch.

It would be good to search for similar issues in other existing expressions, BTW. Let me know if you can take care of it. Thanks.

Sure, count on it.