From be0bae0ad31b0adb506f96de083f52a2bd0d4fbf Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 7 Mar 2024 14:49:08 +0100 Subject: expr: Respect data_len when setting attributes With attr_policy in place, data_len has an upper boundary but it may be lower than the attribute's storage area in which case memcpy() would read garbage. Signed-off-by: Phil Sutter --- src/expr/limit.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'src/expr/limit.c') diff --git a/src/expr/limit.c b/src/expr/limit.c index 935d449..9d02592 100644 --- a/src/expr/limit.c +++ b/src/expr/limit.c @@ -38,19 +38,19 @@ nftnl_expr_limit_set(struct nftnl_expr *e, uint16_t type, switch(type) { case NFTNL_EXPR_LIMIT_RATE: - memcpy(&limit->rate, data, sizeof(limit->rate)); + memcpy(&limit->rate, data, data_len); break; case NFTNL_EXPR_LIMIT_UNIT: - memcpy(&limit->unit, data, sizeof(limit->unit)); + memcpy(&limit->unit, data, data_len); break; case NFTNL_EXPR_LIMIT_BURST: - memcpy(&limit->burst, data, sizeof(limit->burst)); + memcpy(&limit->burst, data, data_len); break; case NFTNL_EXPR_LIMIT_TYPE: - memcpy(&limit->type, data, sizeof(limit->type)); + memcpy(&limit->type, data, data_len); break; case NFTNL_EXPR_LIMIT_FLAGS: - memcpy(&limit->flags, data, sizeof(limit->flags)); + memcpy(&limit->flags, data, data_len); break; } return 0; -- cgit v1.2.3