diff options
| author |   Paul Mackerras <paulus@samba.org> | 2006-02-07 10:43:36 +1100 |
|---|---|---|
| committer | Paul Mackerras <paulus@samba.org> | 2006-02-07 10:43:36 +1100 |
| commit | 6cb6524d90b6e5497e79a1474bdb2f26755d1c02 (patch) | |
| tree | fd475ac8f57a6bd39c976056324d1bc79d11b4c9 /net/ipv4/netfilter/ip_tables.c | |
| parent | [PATCH] sem2mutex: drivers/macintosh/windfarm_core.c (diff) | |
| parent | [PATCH] USB: Fix GPL markings on usb core functions. (diff) | |
| download | linux-dev-6cb6524d90b6e5497e79a1474bdb2f26755d1c02.tar.xz linux-dev-6cb6524d90b6e5497e79a1474bdb2f26755d1c02.zip | |
Merge ../linux-2.6
Diffstat (limited to 'net/ipv4/netfilter/ip_tables.c')
| -rw-r--r-- | net/ipv4/netfilter/ip_tables.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index 2371b2062c2d..16f47c675fef 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -921,6 +921,13 @@ do_replace(void __user *user, unsigned int len) if (len != sizeof(tmp) + tmp.size) return -ENOPROTOOPT; + /* overflow check */ + if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS - + SMP_CACHE_BYTES) + return -ENOMEM; + if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters)) + return -ENOMEM; + newinfo = xt_alloc_table_info(tmp.size); if (!newinfo) return -ENOMEM; |