--- net/bridge/netfilter/ebtables.c

+++ net/bridge/netfilter/ebtables.c

@@ -979,6 +979,8 @@ static int do_replace(struct net *net, v

if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))

return -ENOMEM;

+ tmp.name[sizeof(tmp.name) - 1] = 0;

+

countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;

newinfo = vmalloc(sizeof(*newinfo) + countersize);

if (!newinfo)