You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
61 lines
2.1 KiB
61 lines
2.1 KiB
2 months ago
|
From aecf2107e075bc45e584badf1c67c0badfd116a5 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Phil Sutter <psutter@redhat.com>
|
||
|
|
Date: Wed, 8 May 2024 22:39:40 +0200
|
||
|
|
Subject: [PATCH] set_elem: use nftnl_data_cpy() in
|
||
|
|
NFTNL_SET_ELEM_{KEY,KEY_END,DATA}
|
||
|
|
|
||
|
|
JIRA: https://issues.redhat.com/browse/RHEL-28515
|
||
|
|
Upstream Status: libnftnl commit 974af82c0bb0bc5958ccd759bd3a0f2bddbc8d83
|
||
|
|
|
||
|
|
commit 974af82c0bb0bc5958ccd759bd3a0f2bddbc8d83
|
||
|
|
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
||
|
|
Date: Fri Jan 12 12:33:38 2024 +0100
|
||
|
|
|
||
|
|
set_elem: use nftnl_data_cpy() in NFTNL_SET_ELEM_{KEY,KEY_END,DATA}
|
||
|
|
|
||
|
|
Use safe nftnl_data_cpy() to copy key into union nftnl_data_reg.
|
||
|
|
|
||
|
|
Follow up for commit:
|
||
|
|
|
||
|
|
bc2afbde9eae ("expr: fix buffer overflows in data value setters")
|
||
|
|
|
||
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||
|
|
|
||
|
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||
|
|
---
|
||
|
|
src/set_elem.c | 12 ++++++------
|
||
|
|
1 file changed, 6 insertions(+), 6 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/set_elem.c b/src/set_elem.c
|
||
|
|
index 884faff..9207a0d 100644
|
||
|
|
--- a/src/set_elem.c
|
||
|
|
+++ b/src/set_elem.c
|
||
|
|
@@ -126,12 +126,12 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr,
|
||
|
|
memcpy(&s->set_elem_flags, data, sizeof(s->set_elem_flags));
|
||
|
|
break;
|
||
|
|
case NFTNL_SET_ELEM_KEY: /* NFTA_SET_ELEM_KEY */
|
||
|
|
- memcpy(&s->key.val, data, data_len);
|
||
|
|
- s->key.len = data_len;
|
||
|
|
+ if (nftnl_data_cpy(&s->key, data, data_len) < 0)
|
||
|
|
+ return -1;
|
||
|
|
break;
|
||
|
|
case NFTNL_SET_ELEM_KEY_END: /* NFTA_SET_ELEM_KEY_END */
|
||
|
|
- memcpy(&s->key_end.val, data, data_len);
|
||
|
|
- s->key_end.len = data_len;
|
||
|
|
+ if (nftnl_data_cpy(&s->key_end, data, data_len) < 0)
|
||
|
|
+ return -1;
|
||
|
|
break;
|
||
|
|
case NFTNL_SET_ELEM_VERDICT: /* NFTA_SET_ELEM_DATA */
|
||
|
|
memcpy(&s->data.verdict, data, sizeof(s->data.verdict));
|
||
|
|
@@ -145,8 +145,8 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr,
|
||
|
|
return -1;
|
||
|
|
break;
|
||
|
|
case NFTNL_SET_ELEM_DATA: /* NFTA_SET_ELEM_DATA */
|
||
|
|
- memcpy(s->data.val, data, data_len);
|
||
|
|
- s->data.len = data_len;
|
||
|
|
+ if (nftnl_data_cpy(&s->data, data, data_len) < 0)
|
||
|
|
+ return -1;
|
||
|
|
break;
|
||
|
|
case NFTNL_SET_ELEM_TIMEOUT: /* NFTA_SET_ELEM_TIMEOUT */
|
||
|
|
memcpy(&s->timeout, data, sizeof(s->timeout));
|