From: Dan Carpenter Date: Tue, 18 Nov 2014 08:55:17 +0000 (+0100) Subject: netfilter: ipset: small potential read beyond the end of buffer X-Git-Tag: v6.24~1 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=aeb28678e69ab156800bc8b6be47a29896396e84;p=ipset netfilter: ipset: small potential read beyond the end of buffer We could be reading 8 bytes into a 4 byte buffer here. It seems harmless but adding a check is the right thing to do and it silences a static checker warning. Signed-off-by: Dan Carpenter Acked-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso --- diff --git a/kernel/net/netfilter/ipset/ip_set_core.c b/kernel/net/netfilter/ipset/ip_set_core.c index 872f71e..c2f4b17 100644 --- a/kernel/net/netfilter/ipset/ip_set_core.c +++ b/kernel/net/netfilter/ipset/ip_set_core.c @@ -1892,6 +1892,11 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) /* Check the version at the beginning of operations */ struct ip_set_req_version *req_version = data; + if (*len < sizeof(struct ip_set_req_version)) { + ret = -EINVAL; + goto done; + } + if (req_version->version != IPSET_PROTOCOL) { ret = -EPROTO; goto done;