fixed buffer overflow

8 years ago · 0394bf8987
1 changed files with 6 additions and 4 deletions
--- a/src/ts3init_match.c
+++ b/src/ts3init_match.c
@ -49,7 +49,9 @@ static bool check_header(const struct sk_buff *skb, const struct xt_action_param
				@@ -49,7 +49,9 @@ static bool check_header(const struct sk_buff *skb, const struct xt_action_param
    udp = skb_header_pointer(skb, par->thoff, sizeof(*udp), &header_data->udp_buf);
    data_len = be16_to_cpu(udp->len) - sizeof(*udp);

-    if (data_len < header_size) return false;
+    if (data_len < header_size ||
+        data_len > sizeof(header_data->ts3_header_buf))
+        return false;

    ts3_header = (struct ts3_init_header*) skb_header_pointer(skb, 
        par->thoff + sizeof(*udp), data_len,