netfilter: x_tables: check for bogus target offset

[karo-tx-linux.git] / net / ipv4 / netfilter / arp_tables.c

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 7f3cf5f9d2ecaec8489ff0c84c32c9224594d187..fa907f24616e69212e8469db0c9be4fbe75aebf6 100644 (file)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -494,23 +494,6 @@ next:
        return 1;
 }
 
-static inline int check_entry(const struct arpt_entry *e)
-{
-       const struct xt_entry_target *t;
-
-       if (!arp_checkentry(&e->arp))
-               return -EINVAL;
-
-       if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)
-               return -EINVAL;
-
-       t = arpt_get_target_c(e);
-       if (e->target_offset + t->u.target_size > e->next_offset)
-               return -EINVAL;
-
-       return 0;
-}
-
 static inline int check_target(struct arpt_entry *e, const char *name)
 {
        struct xt_entry_target *t = arpt_get_target(e);
@@ -606,7 +589,11 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
                return -EINVAL;
        }
 
-       err = check_entry(e);
+       if (!arp_checkentry(&e->arp))
+               return -EINVAL;
+
+       err = xt_check_entry_offsets(e, e->elems, e->target_offset,
+                                    e->next_offset);
        if (err)
                return err;
 
@@ -1264,8 +1251,11 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
                return -EINVAL;
        }
 
-       /* For purposes of check_entry casting the compat entry is fine */
-       ret = check_entry((struct arpt_entry *)e);
+       if (!arp_checkentry(&e->arp))
+               return -EINVAL;
+
+       ret = xt_compat_check_entry_offsets(e, e->elems, e->target_offset,
+                                           e->next_offset);
        if (ret)
                return ret;