netfilter: nf_tables: do not allow NFT_SET_ELEM_INTERVAL_END flag and…

… data This combination is not allowed since end interval elements cannot contain data. Signed-off-by: Pablo Neira Ayuso <[email protected]> Acked-by: Patrick McHardy <[email protected]>
strager · Feb 7, 2014 · bd7fc64 · bd7fc64
1 parent 0165d93
commit bd7fc64
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
@@ -2741,6 +2741,9 @@ static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set,
 		if (nla[NFTA_SET_ELEM_DATA] == NULL &&
 		    !(elem.flags & NFT_SET_ELEM_INTERVAL_END))
 			return -EINVAL;
+		if (nla[NFTA_SET_ELEM_DATA] != NULL &&
+		    elem.flags & NFT_SET_ELEM_INTERVAL_END)
+			return -EINVAL;
 	} else {
 		if (nla[NFTA_SET_ELEM_DATA] != NULL)
 			return -EINVAL;