diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2012-03-05 20:22:53 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2012-03-06 14:43:49 -0500 |
commit | a157b9d5b5b626e46eba2ac4e342da8db25cabc4 (patch) | |
tree | 9a269ae569dcce683b31a0b87a12ae6487f64000 /net/bridge | |
parent | 8be619d1e430fd87a02587a2a6830b692cb91b84 (diff) |
netfilter: bridge: fix wrong pointer dereference
In adf7ff8, a invalid dereference was added in ebt_make_names.
CC [M] net/bridge/netfilter/ebtables.o
net/bridge/netfilter/ebtables.c: In function `ebt_make_names':
net/bridge/netfilter/ebtables.c:1371:20: warning: `t' may be used uninitialized in this function [-Wuninitialized]
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge')
-rw-r--r-- | net/bridge/netfilter/ebtables.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index 15e9575f7207..5fe2ff3b01ef 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c | |||
@@ -1368,7 +1368,6 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase) | |||
1368 | if (e->bitmask == 0) | 1368 | if (e->bitmask == 0) |
1369 | return 0; | 1369 | return 0; |
1370 | 1370 | ||
1371 | strncpy(name, t->u.target->name, sizeof(name)); | ||
1372 | hlp = ubase + (((char *)e + e->target_offset) - base); | 1371 | hlp = ubase + (((char *)e + e->target_offset) - base); |
1373 | t = (struct ebt_entry_target *)(((char *)e) + e->target_offset); | 1372 | t = (struct ebt_entry_target *)(((char *)e) + e->target_offset); |
1374 | 1373 | ||
@@ -1378,6 +1377,7 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase) | |||
1378 | ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase); | 1377 | ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase); |
1379 | if (ret != 0) | 1378 | if (ret != 0) |
1380 | return ret; | 1379 | return ret; |
1380 | strncpy(name, t->u.target->name, sizeof(name)); | ||
1381 | if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN)) | 1381 | if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN)) |
1382 | return -EFAULT; | 1382 | return -EFAULT; |
1383 | return 0; | 1383 | return 0; |