leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: ipset: Fix the last missing check of nla_parse_deprecated()

Browse Source 
In dump_init() the outdated comment was incorrect and we had a missing
validation check of nla_parse_deprecated().

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
This commit is contained in:
Jozsef Kadlecsik 2019-06-10 12:50:00 +02:00
parent f4f5748bfe
commit 13c6ba1f85
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/netfilter/ipset/ip_set_core.c
View File

@ -1293,11 +1293,13 @@ dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
struct nlattr *attr = (void *)nlh + min_len; struct nlattr *attr = (void *)nlh + min_len;
u32 dump_type; u32 dump_type;
ip_set_id_t index; ip_set_id_t index;
int ret;
/* Second pass, so parser can't fail */ ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, attr,
nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, attr, nlh->nlmsg_len - min_len,
nlh->nlmsg_len - min_len, ip_set_setname_policy, ip_set_setname_policy, NULL);
NULL); if (ret)
return ret;
cb->args[IPSET_CB_PROTO] = nla_get_u8(cda[IPSET_ATTR_PROTOCOL]); cb->args[IPSET_CB_PROTO] = nla_get_u8(cda[IPSET_ATTR_PROTOCOL]);
if (cda[IPSET_ATTR_SETNAME]) { if (cda[IPSET_ATTR_SETNAME]) {