Subject: Re: [Suggestion] net/netfilter: strcpy for timeout->name

From: Florian Westphal <[email-masked]>
Date: Wed, 21 Nov 2012 12:39:01 +0100

Chen Gang <[email-masked]> wrote:
> Please help checking net/netfilter/nfnetlink_cttimeout.c:
>   I suggest, we use strncpy instead of strcpy at line 143. 
>   just like we have already used strncmp at line 94.
[..]
>   after checking the calling work flow:
>     the length of nla_data(cda[CTA_TIMEOUT_NAME]) is not limited in server side.

Good catch, classic buffer overflow.

I've sent a patch to add the missing "len" policy.  Thanks for reporting
this bug.