From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pablo Neira Ayuso Subject: Re: [patch] netfilter: prevent harmless integer overflow Date: Thu, 20 Jun 2013 12:23:52 +0200 Message-ID: <20130620102352.GA19813@localhost> References: <20130618074603.GF12329@elgon.mountain> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Bart De Schuymer , Patrick McHardy , Stephen Hemminger , "David S. Miller" , netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org, coreteam@netfilter.org, bridge@lists.linux-foundation.org, netdev@vger.kernel.org, kernel-janitors@vger.kernel.org To: Dan Carpenter Return-path: Received: from mail.us.es ([193.147.175.20]:45429 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756268Ab3FTKX4 (ORCPT ); Thu, 20 Jun 2013 06:23:56 -0400 Content-Disposition: inline In-Reply-To: <20130618074603.GF12329@elgon.mountain> Sender: netfilter-devel-owner@vger.kernel.org List-ID: On Tue, Jun 18, 2013 at 10:46:03AM +0300, Dan Carpenter wrote: > This overflow is harmless because a few lines later we check: > > if (num_counters != t->private->nentries) { > > But it still upsets the static checkers. > > Signed-off-by: Dan Carpenter > > diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c > index 3d110c4..141350e 100644 > --- a/net/bridge/netfilter/ebtables.c > +++ b/net/bridge/netfilter/ebtables.c > @@ -1278,6 +1278,8 @@ static int do_update_counters(struct net *net, const char *name, > > if (num_counters == 0) > return -EINVAL; > + if (num_counters > INT_MAX / sizeof(*tmp)) > + return -ENOMEM; This is artificially limiting to INT_MAX / sizeof(struct counters). Before this patch, the limit is UINT_MAX / sizeof(struct counters). I think it's very unlikely to hit such a limit though, but as you mentioned we cover the overflow already. Adding it to calm down a static checker sound a bit too much for me.