|
|
Linaro GCC 4.6-2013.05 incorrectly pads the arpt_arp structure on
at least the ar71xx target, resulting in a two bytes shorter struct
in the kernel compared to what arptables userspace expects.
When comparing sizeof(struct arpt_arp) in kernel and userspace, the
former yields 162 byte, while the latter is 164 byte.
As a consequence, the subsequent target_offset and next_offset
members of the parent arpt_entry structure contain invalid values
when processed by the arptables binary, leading to bad memory
accesses in the populate_cache() procedure, subsequently causing a
segfault.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38999 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
