lkml.org 
[lkml]   [2012]   [Mar]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: Resend [PATCH] netfilter: Fix copy_to_user too small size parametre.
    From
    where is it broken ?
    Can you please explain ?

    Regards
    Santosh

    On Sun, Mar 4, 2012 at 5:48 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
    > On Thu, Mar 01, 2012 at 10:39:03PM +0530, santosh nayak wrote:
    >> From: Santosh Nayak <santoshprasadnayak@gmail.com>
    >>
    >> user-space ebtables expects 32 bytes-long names, but xt_match uses
    >> 29 bytes. Fill the remaining bytes with zeroes.
    >>
    >> Signed-off-by: Santosh Nayak <santoshprasadnayak@gmail.com>
    >> ---
    >>  net/bridge/netfilter/ebtables.c |   14 +++++++++++---
    >>  1 files changed, 11 insertions(+), 3 deletions(-)
    >>
    >> diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
    >> index 5864cc4..21f337a 100644
    >> --- a/net/bridge/netfilter/ebtables.c
    >> +++ b/net/bridge/netfilter/ebtables.c
    >> @@ -1335,7 +1335,10 @@ static inline int ebt_make_matchname(const struct ebt_entry_match *m,
    >>      const char *base, char __user *ubase)
    >>  {
    >>       char __user *hlp = ubase + ((char *)m - base);
    >> -     if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
    >> +     char name[EBT_FUNCTION_MAXNAMELEN] = {};
    >> +
    >> +     strncpy(name, m->u.match->name, sizeof(name));
    >> +     if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
    >>               return -EFAULT;
    >>       return 0;
    >>  }
    >> @@ -1344,7 +1347,10 @@ static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
    >>      const char *base, char __user *ubase)
    >>  {
    >>       char __user *hlp = ubase + ((char *)w - base);
    >> -     if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
    >> +     char name[EBT_FUNCTION_MAXNAMELEN] = {};
    >> +
    >> +     strncpy(name, w->u.watcher->name, sizeof(name));
    >> +     if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
    >>               return -EFAULT;
    >>       return 0;
    >>  }
    >> @@ -1355,10 +1361,12 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
    >>       int ret;
    >>       char __user *hlp;
    >>       const struct ebt_entry_target *t;
    >> +     char name[EBT_FUNCTION_MAXNAMELEN] = {};
    >>
    >>       if (e->bitmask == 0)
    >>               return 0;
    >>
    >> +     strncpy(name, t->u.target->name, sizeof(name));
    >>       hlp = ubase + (((char *)e + e->target_offset) - base);
    >>       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
    >
    > This is broken, t dereference is incorrect. Unfortunately I've applied
    > your patch. I'll apply a patch to fix this upon it.
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2012-03-04 13:43    [W:0.033 / U:64.240 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site