Re: [PATCH nf v4] netfilter: bridge: ebt_among: add more missing match size checks

2018-03-09 Thread Eric Dumazet
On 03/09/2018 02:03 AM, Florian Westphal wrote: ebt_among is special, it has a dynamic match size and is exempt from the central size checks. commit c4585a2823edf ("bridge: ebt_among: add missing match size checks") added validation for pool size, but missed fact that the macros

[PATCH nf v4] netfilter: bridge: ebt_among: add more missing match size checks

2018-03-09 Thread Florian Westphal
ebt_among is special, it has a dynamic match size and is exempt from the central size checks. commit c4585a2823edf ("bridge: ebt_among: add missing match size checks") added validation for pool size, but missed fact that the macros ebt_among_wh_src/dst can already return out-of-bound result