[NETFILTER] arp_tables: Fix unaligned accesses.

There are two device string comparison loops in arp_packet_match().
The first one goes byte-by-byte but the second one tries to be
clever and cast the string to a long and compare by longs.

The device name strings in the arp table entries are not guarenteed
to be aligned enough to make this value, so just use byte-by-byte
for both cases.

Based upon a report by <drraid@gmail.com>.

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 5170f5c75f9d1742e4f47cfdc693543b744cfe10..57b0221f9e249b3f3c4e222fd1c82f1330832358 100644 (file)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -166,13 +166,9 @@ static inline int arp_packet_match(const struct arphdr *arphdr,
                return 0;
        }
 
-       for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
-               unsigned long odev;
-               memcpy(&odev, outdev + i*sizeof(unsigned long),
-                      sizeof(unsigned long));
-               ret |= (odev
-                       ^ ((const unsigned long *)arpinfo->outiface)[i])
-                       & ((const unsigned long *)arpinfo->outiface_mask)[i];
+       for (i = 0, ret = 0; i < IFNAMSIZ; i++) {
+               ret |= (outdev[i] ^ arpinfo->outiface[i])
+                       & arpinfo->outiface_mask[i];
        }
 
        if (FWINV(ret != 0, ARPT_INV_VIA_OUT)) {