Messages in this thread | | | Date | Fri, 3 Nov 2023 10:18:01 +0100 | From | Florian Westphal <> | Subject | Re: [PATCH net] netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() |
| |
Dan Carpenter <dan.carpenter@linaro.org> wrote: > The problem is in nft_byteorder_eval() where we are iterating through a > loop and writing to dst[0], dst[1], dst[2] and so on... On each > iteration we are writing 8 bytes. But dst[] is an array of u32 so each > element only has space for 4 bytes. That means that every iteration > overwrites part of the previous element. > > I spotted this bug while reviewing commit caf3ef7468f7 ("netfilter: > nf_tables: prevent OOB access in nft_byteorder_eval") which is a related > issue. I think that the reason we have not detected this bug in testing > is that most of time we only write one element.
LGTM, thanks Dan. We will route this via nf.git.
| |