On Thu, Jan 15, 2015 at 01:22:22PM +0100, Pablo Neira Ayuso wrote:
> From: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
>
> [ upstream commit 2196937e12b1b4ba139806d132647e1651d655df ]
>
Thank you Pablo, I'll queue both patches for the 3.16 kernel.
Cheers,
--
Luís
> We could be reading 8 bytes into a 4 byte buffer here. It seems
> harmless but adding a check is the right thing to do and it silences a
> static checker warning.
>
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.2.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.4.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.10.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.12.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.14.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.16.x
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.17.x
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Acked-by: Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxxxxxx>
> Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
> ---
> net/netfilter/ipset/ip_set_core.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
> index 86f9d76..d259da3 100644
> --- a/net/netfilter/ipset/ip_set_core.c
> +++ b/net/netfilter/ipset/ip_set_core.c
> @@ -1863,6 +1863,12 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
> if (*op < IP_SET_OP_VERSION) {
> /* Check the version at the beginning of operations */
> struct ip_set_req_version *req_version = data;
> +
> + if (*len < sizeof(struct ip_set_req_version)) {
> + ret = -EINVAL;
> + goto done;
> + }
> +
> if (req_version->version != IPSET_PROTOCOL) {
> ret = -EPROTO;
> goto done;
> --
> 1.7.10.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html