[PATCH nf-next] netfilter: x_physdev: reject empty or not-nul terminated device names

[PATCH nf-next] netfilter: x_physdev: reject empty or not-nul terminated device names

[Florian Westphal]

Reject names that lack a \0 character and reject the empty string as
well. iptables allows this but it fails to re-parse iptables-save output
that contain such rules.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/netfilter/xt_physdev.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 343e65f377d4..1494259fb518 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -107,6 +107,21 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
 		return -EINVAL;
 	}
 
+#define X(memb) strnlen(info->memb , sizeof(info->memb)) >= sizeof(info->memb)
+	if (X(physindev))
+		return -ENAMETOOLONG;
+	if (X(physoutdev))
+		return -ENAMETOOLONG;
+	if (X(in_mask))
+		return -ENAMETOOLONG;
+	if (X(out_mask))
+		return -ENAMETOOLONG;
+#undef X
+	if (info->bitmask & XT_PHYSDEV_OP_IN && info->physindev[0] == 0)
+		return -EINVAL;
+	if (info->bitmask & XT_PHYSDEV_OP_OUT && info->physoutdev[0] == 0)
+		return -EINVAL;
+
 	if (!brnf_probed) {
 		brnf_probed = true;
 		request_module("br_netfilter");
-- 
2.52.0