netfilter: x_tables: ensure names are nul-terminated

Reject names that lack a \0 character before feeding them
to functions that expect c-strings.

Fixes tag is the most recent commit that needs this change.

Fixes: c38c4597e4bf ("netfilter: implement xt_cgroup cgroup2 path match")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index c437fbd59ec130ab6a823a3a01c154d682ec5587..43d2ae2be628dc2b12fd3b122512479ae5c249e9 100644 (file)
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -65,6 +65,9 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
 
        info->priv = NULL;
        if (info->has_path) {
+               if (strnlen(info->path, sizeof(info->path)) >= sizeof(info->path))
+                       return -ENAMETOOLONG;
+
                cgrp = cgroup_get_from_path(info->path);
                if (IS_ERR(cgrp)) {
                        pr_info_ratelimited("invalid path, errno=%ld\n",
@@ -102,6 +105,9 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
 
        info->priv = NULL;
        if (info->has_path) {
+               if (strnlen(info->path, sizeof(info->path)) >= sizeof(info->path))
+                       return -ENAMETOOLONG;
+
                cgrp = cgroup_get_from_path(info->path);
                if (IS_ERR(cgrp)) {
                        pr_info_ratelimited("invalid path, errno=%ld\n",

diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
index 72324bd976af8c5302897e3ab61442c142845f01..b1d736c15fcbe5e22ae9077feb8e1f11c8afa8bb 100644 (file)
--- a/net/netfilter/xt_rateest.c
+++ b/net/netfilter/xt_rateest.c
@@ -91,6 +91,11 @@ static int xt_rateest_mt_checkentry(const struct xt_mtchk_param *par)
                goto err1;
        }
 
+       if (strnlen(info->name1, sizeof(info->name1)) >= sizeof(info->name1))
+               return -ENAMETOOLONG;
+       if (strnlen(info->name2, sizeof(info->name2)) >= sizeof(info->name2))
+               return -ENAMETOOLONG;
+
        ret  = -ENOENT;
        est1 = xt_rateest_lookup(par->net, info->name1);
        if (!est1)