961ed183a9
'buffer' string is copied from userspace. It is not checked whether it is zero terminated. This may lead to overflow inside of simple_strtoul(). Changli Gao suggested to copy not more than user supplied 'size' bytes. It was introduced before the git epoch. Files "ipt_CLUSTERIP/*" are root writable only by default, however, on some setups permissions might be relaxed to e.g. network admin user. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Acked-by: Changli Gao <xiaosuo@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net> |
||
|---|---|---|
| .. | ||
| arp_tables.c | ||
| arpt_mangle.c | ||
| arptable_filter.c | ||
| ip_queue.c | ||
| ip_tables.c | ||
| ipt_ah.c | ||
| ipt_CLUSTERIP.c | ||
| ipt_ecn.c | ||
| ipt_ECN.c | ||
| ipt_LOG.c | ||
| ipt_MASQUERADE.c | ||
| ipt_NETMAP.c | ||
| ipt_REDIRECT.c | ||
| ipt_REJECT.c | ||
| ipt_ULOG.c | ||
| iptable_filter.c | ||
| iptable_mangle.c | ||
| iptable_raw.c | ||
| iptable_security.c | ||
| Kconfig | ||
| Makefile | ||
| nf_conntrack_l3proto_ipv4_compat.c | ||
| nf_conntrack_l3proto_ipv4.c | ||
| nf_conntrack_proto_icmp.c | ||
| nf_defrag_ipv4.c | ||
| nf_nat_amanda.c | ||
| nf_nat_core.c | ||
| nf_nat_ftp.c | ||
| nf_nat_h323.c | ||
| nf_nat_helper.c | ||
| nf_nat_irc.c | ||
| nf_nat_pptp.c | ||
| nf_nat_proto_common.c | ||
| nf_nat_proto_dccp.c | ||
| nf_nat_proto_gre.c | ||
| nf_nat_proto_icmp.c | ||
| nf_nat_proto_sctp.c | ||
| nf_nat_proto_tcp.c | ||
| nf_nat_proto_udp.c | ||
| nf_nat_proto_udplite.c | ||
| nf_nat_proto_unknown.c | ||
| nf_nat_rule.c | ||
| nf_nat_sip.c | ||
| nf_nat_snmp_basic.c | ||
| nf_nat_standalone.c | ||
| nf_nat_tftp.c | ||