--- net/ipv4/netfilter/arp_tables.c

+++ net/ipv4/netfilter/arp_tables.c

@@ -1086,6 +1086,7 @@ static int do_replace(struct net *net, v

/* overflow check */

if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))

return -ENOMEM;

+ tmp.name[sizeof(tmp.name)-1] = 0;

newinfo = xt_alloc_table_info(tmp.size);

if (!newinfo)

@@ -1508,6 +1509,7 @@ static int compat_do_replace(struct net

return -ENOMEM;

if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))

return -ENOMEM;

+ tmp.name[sizeof(tmp.name)-1] = 0;

newinfo = xt_alloc_table_info(tmp.size);

if (!newinfo)

@@ -1763,6 +1765,7 @@ static int do_arpt_get_ctl(struct sock *

ret = -EFAULT;

break;

}

+ rev.name[sizeof(rev.name)-1] = 0;

try_then_request_module(xt_find_revision(NFPROTO_ARP, rev.name,

rev.revision, 1, &ret),