On Sun, Nov 8, 2015 at 8:41 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> On Fri, Oct 30, 2015 at 05:33:03AM -0700, Loganaden Velvindron wrote:
>> counterstmp is not cleared before it is used in get_counters(). it might be
>> leaked partially when it is sent to userland later on.
>
> get_counters() is memcpy'ing the old counter to the counterstmp area
> and updating it.
>
> Where is there leak?
>
In this case, none, due to correct memcpy parameters in get_counters().
However, as this is exposed later on to userland through:
if (copy_to_user(user, counterstmp,
nentries * sizeof(struct ebt_counter)))
zero'ing counterstmp malloc'ed memory, looks like a good idea.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
