History

netfilter: xt_recent: fix stack overread in compat code

Related-to: commit 325fb5b4d26038cba665dd0d8ee09555321061f0 The compat path suffers from a similar problem. It only uses a __be32 when all of the recent code uses, and expects, an nf_inet_addr everywhere. As a result, addresses stored by xt_recents were filled with whatever other stuff was on the stack following the be32. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> With a minor compile fix from Roman.

Jan Engelhardt committed 17 years ago

Commit 37e55cf1 parent 71951b61 file · +4 −5Browse files

Unified · Split

net/netfilter/xt_recent.c+4−5
@@ -474,7 +474,7 @@ static ssize_t recent_old_proc_write(struct file *file, · 473 unmodified lines
474474 struct recent_table *t = pde->data;
475475 struct recent_entry *e;
476476 char buf[sizeof("+255.255.255.255")], *c = buf;
477− __be32 addr;
477+ union nf_inet_addr addr = {};
478478 int add;
479479
480480 if (size > sizeof(buf))
@@ -506,14 +506,13 @@ static ssize_t recent_old_proc_write(struct file *file, · 25 unmodified lines
506506 add = 1;
507507 break;
508508 }
509− addr = in_aton(c);
509+ addr.ip = in_aton(c);
510510
511511 spin_lock_bh(&recent_lock);
512− e = recent_entry_lookup(t, (const void *)&addr, NFPROTO_IPV4, 0);
512+ e = recent_entry_lookup(t, &addr, NFPROTO_IPV4, 0);
513513 if (e == NULL) {
514514 if (add)
515− recent_entry_init(t, (const void *)&addr,
516− NFPROTO_IPV4, 0);
515+ recent_entry_init(t, &addr, NFPROTO_IPV4, 0);
517516 } else {
518517 if (add)
519518 recent_entry_update(t, e);