]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: compat: reject huge allocation requests
authorFlorian Westphal <fw@strlen.de>
Tue, 27 Feb 2018 18:42:35 +0000 (19:42 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 5 Mar 2018 22:15:43 +0000 (23:15 +0100)
commite236fe2567eb21884051dfc767d00a62c01f6c69
tree79624163e94c944c0b0ad6efea062b96ef8d3560
parent3de86f3017130bb641da2291a199196ad0b052cf
netfilter: compat: reject huge allocation requests

no need to bother even trying to allocating huge compat offset arrays,
such ruleset is rejected later on anyway becaus we refuse to allocate
overly large rule blobs.

However, compat translation happens before blob allocation, so we should
add a check there too.

This is supposed to help with fuzzing by avoiding oom-killer.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/x_tables.c