Florian Westphal ce683e5f9d netfilter: x_tables: check for bogus target offset ...

We're currently asserting that targetoff + targetsize <= nextoff.

Extend it to also check that targetoff is >= sizeof(xt_entry).
Since this is generic code, add an argument pointing to the start of the
match/target, we can then derive the base structure size from the delta.

We also need the e->elems pointer in a followup change to validate matches.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2016-04-14 00:30:37 +02:00

..

ipset

netfilter: ipset: fix race condition in ipset save, swap and delete

2016-03-28 17:57:45 +02:00

nf_conntrack_amanda.h

…

nf_conntrack_common.h

…

nf_conntrack_dccp.h

…

nf_conntrack_ftp.h

…

nf_conntrack_h323_asn1.h

…

nf_conntrack_h323_types.h

…

nf_conntrack_h323.h

…

nf_conntrack_irc.h

…

nf_conntrack_pptp.h

…

nf_conntrack_proto_gre.h

…

nf_conntrack_sane.h

…

nf_conntrack_sctp.h

netfilter: nf_ct_sctp: move ip_ct_sctp away from UAPI

2015-11-23 17:54:42 +01:00

nf_conntrack_sip.h

…

nf_conntrack_snmp.h

…

nf_conntrack_tcp.h

…

nf_conntrack_tftp.h

…

nf_conntrack_zones_common.h

netfilter: nf_conntrack: make nf_ct_zone_dflt built-in

2015-09-02 16:32:56 -07:00

nfnetlink_acct.h

netfilter: nfacct: per network namespace support

2015-08-07 11:50:56 +02:00

nfnetlink.h

nfnetlink: remove nfnetlink_alloc_skb

2016-02-18 11:42:19 -05:00

x_tables.h

netfilter: x_tables: check for bogus target offset

2016-04-14 00:30:37 +02:00

xt_hashlimit.h

…

xt_physdev.h

…