[libnftnl PATCH 2/2 v2] Avoid out of bounds read from data

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



When data is smaller than the destination, &ctr->pkts.

This might introduce some issues since we're now not
filling the rest of the memory, but filling out with
uninitialized garbage is probably as bad as leaving it
as garbage.

Signed-off-by: Maya Rashish <mrashish@xxxxxxxxxx>
---
 include/utils.h    | 2 ++
 src/expr/counter.c | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/utils.h b/include/utils.h
index 8af5a8e..6b22e46 100644
--- a/include/utils.h
+++ b/include/utils.h
@@ -67,6 +67,8 @@ void __nftnl_assert_attr_exists(uint16_t attr, uint16_t attr_max,

 #define array_size(arr)		(sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))

+#define	MIN(a,b)		((a) > (b) ? (b) : (a))
+
 const char *nftnl_family2str(uint32_t family);
 int nftnl_str2family(const char *family);

diff --git a/src/expr/counter.c b/src/expr/counter.c
index 89a602e..fb036dd 100644
--- a/src/expr/counter.c
+++ b/src/expr/counter.c
@@ -35,10 +35,10 @@ nftnl_expr_counter_set(struct nftnl_expr *e, uint16_t type,

 	switch(type) {
 	case NFTNL_EXPR_CTR_BYTES:
-		memcpy(&ctr->bytes, data, sizeof(ctr->bytes));
+		memcpy(&ctr->bytes, data, MIN(data_len, sizeof(ctr->bytes)));
 		break;
 	case NFTNL_EXPR_CTR_PACKETS:
-		memcpy(&ctr->pkts, data, sizeof(ctr->pkts));
+		memcpy(&ctr->pkts, data, MIN(data_len, sizeof(ctr->pkts)));
 		break;
 	default:
 		return -1;
--
2.29.2




[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux