target/linux/generic/patches-4.9/612-netfilter_match_reduce_memory_access.patch

   1 --- a/net/ipv4/netfilter/ip_tables.c
   2 +++ b/net/ipv4/netfilter/ip_tables.c
   3 @@ -61,9 +61,9 @@ ip_packet_match(const struct iphdr *ip,
   4         if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
   5                 return true;
   6
   7 -       if (NF_INVF(ipinfo, IPT_INV_SRCIP,
   8 +       if (NF_INVF(ipinfo, IPT_INV_SRCIP, ipinfo->smsk.s_addr &&
   9                     (ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) ||
  10 -           NF_INVF(ipinfo, IPT_INV_DSTIP,
  11 +           NF_INVF(ipinfo, IPT_INV_DSTIP, ipinfo->dmsk.s_addr &&
  12                     (ip->daddr & ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr))
  13                 return false;
  14