diff options
| author | David Dull <monderasdor@gmail.com> | 2026-03-07 20:26:21 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2026-03-10 14:10:42 +0100 |
| commit | cfe770220ac2dbd3e104c6b45094037455da81d4 (patch) | |
| tree | b49b7c5c4f34bea55f5d1fab58914cc71ea086d6 /tools/perf/scripts/python/bin/stackcollapse-record | |
| parent | d6d8cd2db236a9dd13dbc2d05843b3445cc964b5 (diff) | |
| download | linux-cfe770220ac2dbd3e104c6b45094037455da81d4.tar.gz linux-cfe770220ac2dbd3e104c6b45094037455da81d4.zip | |
netfilter: x_tables: guard option walkers against 1-byte tail reads
When the last byte of options is a non-single-byte option kind, walkers
that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
of the option area.
Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
in xt_tcpudp and xt_dccp option walkers.
Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
Signed-off-by: David Dull <monderasdor@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-record')
0 files changed, 0 insertions, 0 deletions