tree f21ee379a64d8ad12edd80c2b102916d4a1b8b37
parent 8a865621540c7bc7f03665a2b7029cb444a9593a
author Florian Westphal <fw@strlen.de> 1459513049 +0200
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1466788703 -0700

netfilter: x_tables: validate all offsets and sizes in a rule

commit 13631bfc604161a9d69cd68991dff8603edd66f9 upstream.

Validate that all matches (if any) add up to the beginning of
the target and that each match covers at least the base structure size.

The compat path should be able to safely re-use the function
as the structures only differ in alignment; added a
BUILD_BUG_ON just in case we have an arch that adds padding as well.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>