netfilter: x_tables: fix compat match/target pad out-of-bound write

[sfrench/cifs-2.6.git] / net / ipv6 / netfilter / ip6_tables.c

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 2e2119bfcf137348e1ee77dcd360267e2ef47d77..eb2b5404806c649c2fe4cb0c51b4481dace1652b 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1443,6 +1443,8 @@ translate_compat_table(struct net *net,
        if (!newinfo)
                goto out_unlock;
 
+       memset(newinfo->entries, 0, size);
+
        newinfo->number = compatr->num_entries;
        for (i = 0; i < NF_INET_NUMHOOKS; i++) {
                newinfo->hook_entry[i] = compatr->hook_entry[i];