History

netfilter: xt_recent: fix stack overread in compat code

Related-to: commit 325fb5b4d26038cba665dd0d8ee09555321061f0 The compat path suffers from a similar problem. It only uses a __be32 when all of the recent code uses, and expects, an nf_inet_addr everywhere. As a result, addresses stored by xt_recents were filled with whatever other stuff was on the stack following the be32. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> With a minor compile fix from Roman.

Jan Engelhardt committed 17 years ago

Commit 37e55cf1 parent 71951b61 file · +4 −5Browse files

Unified · Split

net/netfilter/xt_recent.c+4−5
@@ -474,7 +474,7 @@ static ssize_t recent_old_proc_write(struct file *file, · 473 unmodified lines
474 struct recent_table *t = pde->data;474 struct recent_table *t = pde->data;
475 struct recent_entry *e;475 struct recent_entry *e;
476 char buf[sizeof("+255.255.255.255")], *c = buf;476 char buf[sizeof("+255.255.255.255")], *c = buf;
477 __be32 addr;477 union nf_inet_addr addr = {};
478 int add;478 int add;
479 479
480 if (size > sizeof(buf))480 if (size > sizeof(buf))
@@ -506,14 +506,13 @@ static ssize_t recent_old_proc_write(struct file *file, · 25 unmodified lines
506 add = 1;506 add = 1;
507 break;507 break;
508 }508 }
509 addr = in_aton(c);509 addr.ip = in_aton(c);
510 510
511 spin_lock_bh(&recent_lock);511 spin_lock_bh(&recent_lock);
512 e = recent_entry_lookup(t, (const void *)&addr, NFPROTO_IPV4, 0);512 e = recent_entry_lookup(t, &addr, NFPROTO_IPV4, 0);
513 if (e == NULL) {513 if (e == NULL) {
514 if (add)514 if (add)
515 recent_entry_init(t, (const void *)&addr,515 recent_entry_init(t, &addr, NFPROTO_IPV4, 0);
516 NFPROTO_IPV4, 0);
517 } else {516 } else {
518 if (add)517 if (add)
519 recent_entry_update(t, e);518 recent_entry_update(t, e);