1 files changed, 15 insertions, 5 deletions

diff --git a/src/expr.c b/src/expr.c
index 8e0bce2..4e32189 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -71,6 +71,16 @@ int nftnl_expr_set(struct nftnl_expr *expr, uint16_t type,
 	case NFTNL_EXPR_NAME:	/* cannot be modified */
 		return 0;
 	default:
+		if (type < NFTNL_EXPR_BASE || type > expr->ops->nftnl_max_attr)
+			return -1;
+
+		if (!expr->ops->attr_policy)
+			return -1;
+
+		if (expr->ops->attr_policy[type].maxlen &&
+		    expr->ops->attr_policy[type].maxlen < data_len)
+			return -1;
+
 		if (expr->ops->set(expr, type, data, data_len) < 0)
 			return -1;
 	}
@@ -270,19 +280,19 @@ err1:
 }
 
 EXPORT_SYMBOL(nftnl_expr_snprintf);
-int nftnl_expr_snprintf(char *buf, size_t size, const struct nftnl_expr *expr,
+int nftnl_expr_snprintf(char *buf, size_t remain, const struct nftnl_expr *expr,
 			uint32_t type, uint32_t flags)
 {
 	int ret;
-	unsigned int offset = 0, remain = size;
+	unsigned int offset = 0;
 
-	if (size)
+	if (remain)
 		buf[0] = '\0';
 
-	if (!expr->ops->snprintf)
+	if (!expr->ops->output || type != NFTNL_OUTPUT_DEFAULT)
 		return 0;
 
-	ret = expr->ops->snprintf(buf + offset, remain, type, flags, expr);
+	ret = expr->ops->output(buf + offset, remain, flags, expr);
 	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
 
 	return offset;