Messages in this thread | | | Date | Sun, 4 Mar 2012 18:03:57 +0100 | From | Pablo Neira Ayuso <> | Subject | Re: Resend [PATCH] netfilter: Fix copy_to_user too small size parametre. |
| |
On Sun, Mar 04, 2012 at 06:09:08PM +0530, santosh prasad nayak wrote: > where is it broken ? > Can you please explain ?
> >> + strncpy(name, t->u.target->name, sizeof(name)); > >> hlp = ubase + (((char *)e + e->target_offset) - base); > >> t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
In ebt_make_names, you dereference t but it is not initialized.
Note that strncpy refers to t->u.target->name which is initialized a couple of lines after it. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |