Re: [PATCH] netfilter: fix possible ZERO_SIZE_PTR pointer dereferencing error.
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2016-06-01 09:27:18
Also in:
netfilter-devel
On Wed, Jun 01, 2016 at 04:34:28PM +0800, Xiubo Li wrote:
quoted hunk ↗ jump to hunk
Since we cannot make sure the 'hook_mask' will always be none zero here. If it equals to zero, the num_hooks will be zero too, and then kmalloc() will return ZERO_SIZE_PTR, which is (void *)16. Then the following error check will fails: ops = kmalloc(sizeof(*ops) * num_hooks, GFP_KERNEL); if (ops == NULL) return ERR_PTR(-ENOMEM); So this patch fix this with just doing the zero check before calling kmalloc() is called. Maybe the case above will never happen here, but in theory. Signed-off-by: Xiubo Li <redacted> --- net/netfilter/x_tables.c | 3 +++ 1 file changed, 3 insertions(+)diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c index c8a0b7d..4df8e38 100644 --- a/net/netfilter/x_tables.c +++ b/net/netfilter/x_tables.c@@ -1185,6 +1185,9 @@ struct nf_hook_ops *xt_hook_link(const struct xt_table *table, nf_hookfn *fn)
What kernel version are you using? I don't see xt_hook_link() in the development tree.
struct nf_hook_ops *ops; int ret; + if (!num_hooks) + return ERR_PTR(-EINVAL); + ops = kmalloc(sizeof(*ops) * num_hooks, GFP_KERNEL); if (ops == NULL) return ERR_PTR(-ENOMEM); -- 1.8.3.1