[PATCH nf-next 3/3] netfilter: ebtables: bound num_counters in do_update_counters()

[Florian Westphal <fw@strlen.de>]

sashiko says:
 it appears the exact same
 pattern remains unfixed in the sibling function do_update_counters().

Fixes: 43ae85af154b ("netfilter: ebtables: bound num_counters like nentries in do_replace()")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/bridge/netfilter/ebtables.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 7238e48d51a1..80008664ebe5 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1390,6 +1390,9 @@ static int do_update_counters(struct net *net, const char *name,
 	if (num_counters == 0)
 		return -EINVAL;
 
+	if (num_counters >= MAX_EBT_ENTRIES)
+		return -ENOMEM;
+
 	tmp = vmalloc_array(num_counters, sizeof(*tmp));
 	if (!tmp)
 		return -ENOMEM;
-- 
2.55.0