diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-01-12 12:33:38 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-01-13 00:24:46 +0100 |
| commit | 974af82c0bb0bc5958ccd759bd3a0f2bddbc8d83 (patch) | |
| tree | c60c2b702e916ee16e59c31487089a91184a0d4f /src/set_elem.c | |
| parent | 407f616ea53184ac3bfb9930d3f27ae1cff9c348 (diff) | |
set_elem: use nftnl_data_cpy() in NFTNL_SET_ELEM_{KEY,KEY_END,DATA}
Use safe nftnl_data_cpy() to copy key into union nftnl_data_reg.
Follow up for commit:
bc2afbde9eae ("expr: fix buffer overflows in data value setters")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/set_elem.c')
| -rw-r--r-- | src/set_elem.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/src/set_elem.c b/src/set_elem.c index 884faff..9207a0d 100644 --- a/src/set_elem.c +++ b/src/set_elem.c @@ -126,12 +126,12 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr, memcpy(&s->set_elem_flags, data, sizeof(s->set_elem_flags)); break; case NFTNL_SET_ELEM_KEY: /* NFTA_SET_ELEM_KEY */ - memcpy(&s->key.val, data, data_len); - s->key.len = data_len; + if (nftnl_data_cpy(&s->key, data, data_len) < 0) + return -1; break; case NFTNL_SET_ELEM_KEY_END: /* NFTA_SET_ELEM_KEY_END */ - memcpy(&s->key_end.val, data, data_len); - s->key_end.len = data_len; + if (nftnl_data_cpy(&s->key_end, data, data_len) < 0) + return -1; break; case NFTNL_SET_ELEM_VERDICT: /* NFTA_SET_ELEM_DATA */ memcpy(&s->data.verdict, data, sizeof(s->data.verdict)); @@ -145,8 +145,8 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr, return -1; break; case NFTNL_SET_ELEM_DATA: /* NFTA_SET_ELEM_DATA */ - memcpy(s->data.val, data, data_len); - s->data.len = data_len; + if (nftnl_data_cpy(&s->data, data, data_len) < 0) + return -1; break; case NFTNL_SET_ELEM_TIMEOUT: /* NFTA_SET_ELEM_TIMEOUT */ memcpy(&s->timeout, data, sizeof(s->timeout)); |