rule: Fix segfault due to invalid free of rule user data

If the user allocates a nftnl_udata_buf and then passes the TLV data to
nftnl_rule_set_data, the pointer stored in rule.user.data is not the
begining of the allocated block. In this situation, if it calls to
nftnl_rule_free, it tries to free this pointer and segfault is thrown.

Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 5 insertions, 1 deletions

diff --git a/src/rule.c b/src/rule.c
index c299548..8ee8648 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -167,7 +167,11 @@ void nftnl_rule_set_data(struct nftnl_rule *r, uint16_t attr,
 		if (r->user.data != NULL)
 			xfree(r->user.data);
 
-		r->user.data = (void *)data;
+		r->user.data = malloc(data_len);
+		if (!r->user.data)
+			return;
+
+		memcpy(r->user.data, data, data_len);
 		r->user.len = data_len;
 		break;
 	}