On Sun, Nov 08, 2015 at 08:52:50PM +0000, Loganaden Velvindron wrote: > On Sun, Nov 8, 2015 at 8:41 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > On Fri, Oct 30, 2015 at 05:33:03AM -0700, Loganaden Velvindron wrote: > >> counterstmp is not cleared before it is used in get_counters(). it might be > >> leaked partially when it is sent to userland later on. > > > > get_counters() is memcpy'ing the old counter to the counterstmp area > > and updating it. > > > > Where is there leak? > > > > In this case, none, due to correct memcpy parameters in get_counters(). > > However, as this is exposed later on to userland through: > > if (copy_to_user(user, counterstmp, > nentries * sizeof(struct ebt_counter))) > > zero'ing counterstmp malloc'ed memory, looks like a good idea. We allocate room for nentries, then we get_counters() those nentries that memcpy that area, and we copy back to user nentries. Where is the problem? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
