diff options
| author | Florian Westphal <fw@strlen.de> | 2023-12-12 15:01:17 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-12-12 16:11:15 +0100 |
| commit | bc2afbde9eae491bcef23ef5b24b25c7605ad911 (patch) | |
| tree | becc43a77fdf77975b5cfa3f61de8dea7cf4ee7c /include/data_reg.h | |
| parent | ff117f50d2f99c03a65b4952b1a6988a8adc700f (diff) | |
expr: fix buffer overflows in data value setters
The data value setters memcpy() to a fixed-size buffer, but its very easy
to make nft pass too-larger values. Example:
@th,160,1272 gt 0
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000[..]
Truncate the copy instead of corrupting the heap.
This needs additional fixes on nft side to reject such statements with a
proper error message.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'include/data_reg.h')
| -rw-r--r-- | include/data_reg.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/data_reg.h b/include/data_reg.h index 6d2dc66..5ee7080 100644 --- a/include/data_reg.h +++ b/include/data_reg.h @@ -37,4 +37,6 @@ struct nlattr; int nftnl_parse_data(union nftnl_data_reg *data, struct nlattr *attr, int *type); void nftnl_free_verdict(const union nftnl_data_reg *data); +int nftnl_data_cpy(union nftnl_data_reg *dreg, const void *src, uint32_t len); + #endif |