lkml.org 
[lkml]   [2010]   [Mar]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[103/145] netfilter: xt_recent: fix buffer overflow
    2.6.32-stable review patch.  If anyone has any objections, please let me know.

    ----------------
    From: Tim Gardner <tim.gardner@canonical.com>

    commit 2c08522e5d2f0af2d6f05be558946dcbf8173683 upstream.

    e->index overflows e->stamps[] every ip_pkt_list_tot packets.

    Consider the case when ip_pkt_list_tot==1; the first packet received is stored
    in e->stamps[0] and e->index is initialized to 1. The next received packet
    timestamp is then stored at e->stamps[1] in recent_entry_update(),
    a buffer overflow because the maximum e->stamps[] index is 0.

    Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/netfilter/xt_recent.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/netfilter/xt_recent.c
    +++ b/net/netfilter/xt_recent.c
    @@ -173,10 +173,10 @@ recent_entry_init(struct recent_table *t

    static void recent_entry_update(struct recent_table *t, struct recent_entry *e)
    {
    + e->index %= ip_pkt_list_tot;
    e->stamps[e->index++] = jiffies;
    if (e->index > e->nstamps)
    e->nstamps = e->index;
    - e->index %= ip_pkt_list_tot;
    list_move_tail(&e->lru_list, &t->lru_list);
    }




    \
     
     \ /
      Last update: 2010-03-13 01:41    [W:0.018 / U:34.928 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site