From f7a564c88da2e1a2feb0fece7abbc3eea89da189 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Mon, 31 Jul 2006 23:47:31 -0700 Subject: [PATCH] --- yaml --- r: 33093 b: refs/heads/master c: 3ab720881b6e36bd5190a3a11cee8d8d067c4ad7 h: refs/heads/master i: 33091: f1b8d6b698043116fc77170f76e88e81d2f3b627 v: v3 --- [refs] | 2 +- trunk/net/ipv4/netfilter/ipt_hashlimit.c | 3 +++ trunk/net/netfilter/xt_string.c | 5 ++++- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/[refs] b/[refs] index 626f976bb345..cb7aef3a315c 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: b10866fd7dd9ae9b8dd03646d28702a76d624474 +refs/heads/master: 3ab720881b6e36bd5190a3a11cee8d8d067c4ad7 diff --git a/trunk/net/ipv4/netfilter/ipt_hashlimit.c b/trunk/net/ipv4/netfilter/ipt_hashlimit.c index 92980ab8ce48..6b662449e825 100644 --- a/trunk/net/ipv4/netfilter/ipt_hashlimit.c +++ b/trunk/net/ipv4/netfilter/ipt_hashlimit.c @@ -508,6 +508,9 @@ hashlimit_checkentry(const char *tablename, if (!r->cfg.expire) return 0; + if (r->name[sizeof(r->name) - 1] != '\0') + return 0; + /* This is the best we've got: We cannot release and re-grab lock, * since checkentry() is called before ip_tables.c grabs ipt_mutex. * We also cannot grab the hashtable spinlock, since htable_create will diff --git a/trunk/net/netfilter/xt_string.c b/trunk/net/netfilter/xt_string.c index 0ebb6ac2c8c7..d8e3891b5f8b 100644 --- a/trunk/net/netfilter/xt_string.c +++ b/trunk/net/netfilter/xt_string.c @@ -55,7 +55,10 @@ static int checkentry(const char *tablename, /* Damn, can't handle this case properly with iptables... */ if (conf->from_offset > conf->to_offset) return 0; - + if (conf->algo[XT_STRING_MAX_ALGO_NAME_SIZE - 1] != '\0') + return 0; + if (conf->patlen > XT_STRING_MAX_PATTERN_SIZE) + return 0; ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen, GFP_KERNEL, TS_AUTOLOAD); if (IS_ERR(ts_conf))