3 files changed, 13 insertions, 3 deletions

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 4133b0f513af..82a434bf8653 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -439,6 +439,8 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
                                 size = e->next_offset;
                                 e = (struct arpt_entry *)
                                         (entry0 + pos + size);
+                                if (pos + size >= newinfo->size)
+                                        return 0;
                                 e->counters.pcnt = pos;
                                 pos += size;
                         } else {
@@ -461,6 +463,8 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
                                 } else {
                                         /* ... this is a fallthru */
                                         newpos = pos + e->next_offset;
+                                        if (newpos >= newinfo->size)
+                                                return 0;
                                 }
                                 e = (struct arpt_entry *)
                                         (entry0 + newpos);
@@ -691,10 +695,8 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
                 }
         }
 
-        if (!mark_source_chains(newinfo, repl->valid_hooks, entry0)) {
-                duprintf("Looping hook\n");
+        if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
                 return -ELOOP;
-        }
 
         /* Finally, each sanity check must pass */
         i = 0;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 631c100a1338..e301a3db4717 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -520,6 +520,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
                                 size = e->next_offset;
                                 e = (struct ipt_entry *)
                                         (entry0 + pos + size);
+                                if (pos + size >= newinfo->size)
+                                        return 0;
                                 e->counters.pcnt = pos;
                                 pos += size;
                         } else {
@@ -541,6 +543,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
                                 } else {
                                         /* ... this is a fallthru */
                                         newpos = pos + e->next_offset;
+                                        if (newpos >= newinfo->size)
+                                                return 0;
                                 }
                                 e = (struct ipt_entry *)
                                         (entry0 + newpos);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 86b67b70b626..7b3335bce3fd 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -532,6 +532,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
                                 size = e->next_offset;
                                 e = (struct ip6t_entry *)
                                         (entry0 + pos + size);
+                                if (pos + size >= newinfo->size)
+                                        return 0;
                                 e->counters.pcnt = pos;
                                 pos += size;
                         } else {
@@ -553,6 +555,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
                                 } else {
                                         /* ... this is a fallthru */
                                         newpos = pos + e->next_offset;
+                                        if (newpos >= newinfo->size)
+                                                return 0;
                                 }
                                 e = (struct ip6t_entry *)
                                         (entry0 + newpos);