--- net/ipv6/netfilter/ip6_tables.c

+++ net/ipv6/netfilter/ip6_tables.c

@@ -1323,6 +1323,7 @@ do_replace(struct net *net, void __user

/* overflow check */

if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))

return -ENOMEM;

+ tmp.name[sizeof(tmp.name)-1] = 0;

newinfo = xt_alloc_table_info(tmp.size);

if (!newinfo)

@@ -1855,6 +1856,7 @@ compat_do_replace(struct net *net, void

return -ENOMEM;

if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))

return -ENOMEM;

+ tmp.name[sizeof(tmp.name)-1] = 0;

newinfo = xt_alloc_table_info(tmp.size);

if (!newinfo)

@@ -2079,6 +2081,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd

ret = -EFAULT;

break;

}

+ rev.name[sizeof(rev.name)-1] = 0;

if (cmd == IP6T_SO_GET_REVISION_TARGET)

target = 1;