On Sun, Nov 8, 2015 at 9:30 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Sun, Nov 08, 2015 at 08:52:50PM +0000, Loganaden Velvindron wrote: >> On Sun, Nov 8, 2015 at 8:41 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: >> > On Fri, Oct 30, 2015 at 05:33:03AM -0700, Loganaden Velvindron wrote: >> >> counterstmp is not cleared before it is used in get_counters(). it might be >> >> leaked partially when it is sent to userland later on. >> > >> > get_counters() is memcpy'ing the old counter to the counterstmp area >> > and updating it. >> > >> > Where is there leak? >> > >> >> In this case, none, due to correct memcpy parameters in get_counters(). >> >> However, as this is exposed later on to userland through: >> >> if (copy_to_user(user, counterstmp, >> nentries * sizeof(struct ebt_counter))) >> >> zero'ing counterstmp malloc'ed memory, looks like a good idea. > > We allocate room for nentries, then we get_counters() those nentries > that memcpy that area, and we copy back to user nentries. > > Where is the problem? None in this case. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
