diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-10-13 08:42:17 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-10-17 18:57:02 +0200 |
| commit | ccca6607c545534e5b74ef04e0f2f6ba11344be4 (patch) | |
| tree | 5288ff52b3888084f4462615a842e76c0d2302b3 | |
| parent | 21a9e0f1568eaa0aad970c06e4cc8d77de8d9fa1 (diff) | |
| download | linux-ccca6607c545534e5b74ef04e0f2f6ba11344be4.tar.gz linux-ccca6607c545534e5b74ef04e0f2f6ba11344be4.tar.bz2 linux-ccca6607c545534e5b74ef04e0f2f6ba11344be4.zip | |
netfilter: nft_range: validate operation netlink attribute
Use nft_parse_u32_check() to make sure we don't get a value over the
unsigned 8-bit integer. Moreover, make sure this value doesn't go over
the two supported range comparison modes.
Fixes: 9286c2eb1fda ("netfilter: nft_range: validate operation netlink attribute")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | net/netfilter/nft_range.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c index c6d5358482d1..9bc4586c3006 100644 --- a/net/netfilter/nft_range.c +++ b/net/netfilter/nft_range.c @@ -59,6 +59,7 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr struct nft_range_expr *priv = nft_expr_priv(expr); struct nft_data_desc desc_from, desc_to; int err; + u32 op; err = nft_data_init(NULL, &priv->data_from, sizeof(priv->data_from), &desc_from, tb[NFTA_RANGE_FROM_DATA]); @@ -80,7 +81,20 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr if (err < 0) goto err2; - priv->op = ntohl(nla_get_be32(tb[NFTA_RANGE_OP])); + err = nft_parse_u32_check(tb[NFTA_RANGE_OP], U8_MAX, &op); + if (err < 0) + goto err2; + + switch (op) { + case NFT_RANGE_EQ: + case NFT_RANGE_NEQ: + break; + default: + err = -EINVAL; + goto err2; + } + + priv->op = op; priv->len = desc_from.len; return 0; err2: |