--- net/ipv4/netfilter/ip_tables.c

+++ net/ipv4/netfilter/ip_tables.c

@@ -1290,6 +1290,7 @@ do_replace(struct net *net, void __user

/* overflow check */

if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))

return -ENOMEM;

+ tmp.name[sizeof(tmp.name)-1] = 0;

newinfo = xt_alloc_table_info(tmp.size);

if (!newinfo)

@@ -1820,6 +1821,7 @@ compat_do_replace(struct net *net, void

return -ENOMEM;

if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))

return -ENOMEM;

+ tmp.name[sizeof(tmp.name)-1] = 0;

newinfo = xt_alloc_table_info(tmp.size);

if (!newinfo)

@@ -2044,6 +2046,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd,

ret = -EFAULT;

break;

}

+ rev.name[sizeof(rev.name)-1] = 0;

if (cmd == IPT_SO_GET_REVISION_TARGET)

target = 1;