diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-01-11 01:13:37 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-01-11 23:22:54 +0100 |
commit | 407f616ea53184ac3bfb9930d3f27ae1cff9c348 (patch) | |
tree | 6a0791e1ecf6e29e3f0267977381a8a3400d8352 /src/set.c | |
parent | 2f4f8f6024f9d7dbc9fe7a943b3d72d2aaefc84e (diff) |
set: buffer overflow in NFTNL_SET_DESC_CONCAT setter
Allow to set a maximum limit of sizeof(s->desc.field_len) which is 16
bytes, otherwise, bail out. Ensure s->desc.field_count does not go over
the array boundary.
Fixes: 7cd41b5387ac ("set: Add support for NFTA_SET_DESC_CONCAT attributes")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/set.c')
-rw-r--r-- | src/set.c | 8 |
1 files changed, 7 insertions, 1 deletions
@@ -194,8 +194,14 @@ int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data, memcpy(&s->desc.size, data, sizeof(s->desc.size)); break; case NFTNL_SET_DESC_CONCAT: + if (data_len > sizeof(s->desc.field_len)) + return -1; + memcpy(&s->desc.field_len, data, data_len); - while (s->desc.field_len[++s->desc.field_count]); + while (s->desc.field_len[++s->desc.field_count]) { + if (s->desc.field_count >= NFT_REG32_COUNT) + break; + } break; case NFTNL_SET_TIMEOUT: memcpy(&s->timeout, data, sizeof(s->timeout)); |