]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: nft_exthdr: call ipv6_find_hdr() with explicitly initialized offset
authorDaniel Borkmann <dborkman@redhat.com>
Fri, 20 Dec 2013 10:23:15 +0000 (11:23 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 20 Dec 2013 10:25:10 +0000 (11:25 +0100)
commitf4c12a15987583e2c87bfbba526017355d820600
treecd92c0d458124da2078fefc34275e6d9aebc4c8f
parent21463a78578636615511ea361ef37097405479b4
netfilter: nft_exthdr: call ipv6_find_hdr() with explicitly initialized offset

In nft's nft_exthdr_eval() routine we process IPv6 extension header
through invoking ipv6_find_hdr(), but we call it with an uninitialized
offset variable that contains some stack value. In ipv6_find_hdr()
we then test if the value of offset != 0 and call skb_header_pointer()
on that offset in order to map struct ipv6hdr into it. Fix it up by
initializing offset to 0 as it was probably intended to be.

Fixes: 4a4835e91e03 ("netfilter: add nftables")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nft_exthdr.c