---

yaml
---
r: 33093
b: refs/heads/master
c: 3ab7208
h: refs/heads/master
i:
  33091: f1b8d6b
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b10866fd7dd9ae9b8dd03646d28702a76d624474
+refs/heads/master: 3ab720881b6e36bd5190a3a11cee8d8d067c4ad7

trunk/net/ipv4/netfilter/ipt_hashlimit.c

@@ -508,6 +508,9 @@ hashlimit_checkentry(const char *tablename,
 	if (!r->cfg.expire)
 		return 0;
 
+	if (r->name[sizeof(r->name) - 1] != '\0')
+		return 0;
+
 	/* This is the best we've got: We cannot release and re-grab lock,
 	 * since checkentry() is called before ip_tables.c grabs ipt_mutex.  
 	 * We also cannot grab the hashtable spinlock, since htable_create will 

trunk/net/netfilter/xt_string.c

@@ -55,7 +55,10 @@ static int checkentry(const char *tablename,
 	/* Damn, can't handle this case properly with iptables... */
 	if (conf->from_offset > conf->to_offset)
 		return 0;
-
+	if (conf->algo[XT_STRING_MAX_ALGO_NAME_SIZE - 1] != '\0')
+	    	return 0;
+	if (conf->patlen > XT_STRING_MAX_PATTERN_SIZE)
+		return 0;
 	ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen,
 				     GFP_KERNEL, TS_AUTOLOAD);
 	if (IS_ERR(ts_conf))