diff options
-rw-r--r-- | net/netfilter/nfnetlink.c | 16 |
1 files changed, 2 insertions, 14 deletions
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c index 9ba6aa486f35..dec36abdf949 100644 --- a/net/netfilter/nfnetlink.c +++ b/net/netfilter/nfnetlink.c | |||
@@ -151,26 +151,14 @@ nfnetlink_check_attributes(struct nfnetlink_subsystem *subsys, | |||
151 | struct nlmsghdr *nlh, struct nfattr *cda[]) | 151 | struct nlmsghdr *nlh, struct nfattr *cda[]) |
152 | { | 152 | { |
153 | int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg)); | 153 | int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg)); |
154 | u_int16_t attr_count; | ||
155 | u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type); | 154 | u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type); |
156 | 155 | u_int16_t attr_count = subsys->cb[cb_id].attr_count; | |
157 | attr_count = subsys->cb[cb_id].attr_count; | ||
158 | memset(cda, 0, sizeof(struct nfattr *) * attr_count); | ||
159 | 156 | ||
160 | /* check attribute lengths. */ | 157 | /* check attribute lengths. */ |
161 | if (likely(nlh->nlmsg_len > min_len)) { | 158 | if (likely(nlh->nlmsg_len > min_len)) { |
162 | struct nfattr *attr = NFM_NFA(NLMSG_DATA(nlh)); | 159 | struct nfattr *attr = NFM_NFA(NLMSG_DATA(nlh)); |
163 | int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len); | 160 | int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len); |
164 | 161 | nfattr_parse(cda, attr_count, attr, attrlen); | |
165 | while (NFA_OK(attr, attrlen)) { | ||
166 | unsigned flavor = NFA_TYPE(attr); | ||
167 | if (flavor) { | ||
168 | if (flavor > attr_count) | ||
169 | return -EINVAL; | ||
170 | cda[flavor - 1] = attr; | ||
171 | } | ||
172 | attr = NFA_NEXT(attr, attrlen); | ||
173 | } | ||
174 | } | 162 | } |
175 | 163 | ||
176 | /* implicit: if nlmsg_len == min_len, we return 0, and an empty | 164 | /* implicit: if nlmsg_len == min_len, we return 0, and an empty |