[PATCH nf-next 2/4] netfilter: xt_CT: check for nul-terminated timeout and helper name

[Pablo Neira Ayuso <pablo@netfilter.org>]

Otherwise, ignore malformed helper/timeout string that userspace
provides.

Fixes: 84f3bb9ae9db ("netfilter: xtables: add CT target")
Fixes: 24de58f46516 ("netfilter: xt_CT: allow to attach timeout policy + glue code")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/xt_CT.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index e78660dfdf4b..91326014ade1 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 		goto err3;
 	}
 
-	if (info->helper[0]) {
+	if (info->helper[0] &&
+	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
 		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
 			ret = -ENAMETOOLONG;
 			goto err3;
@@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 			goto err3;
 	}
 
-	if (info->timeout[0]) {
+	if (info->timeout[0] &&
+	    strnlen(info->timeout, sizeof(info->timeout)) < sizeof(info->timeout)) {
 		if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
 			ret = -ENAMETOOLONG;
 			goto err4;
-- 
2.47.3