Instead of the remaining buffer length, the used buffer length was passed to object's snprintf callback (and the final snprintf call). Fixes: 5573d0146c1ae ("src: support for stateful objects") Signed-off-by: Phil Sutter <phil@xxxxxx> --- src/object.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/object.c b/src/object.c index 008badeea9b66..46e79168daa76 100644 --- a/src/object.c +++ b/src/object.c @@ -396,11 +396,11 @@ static int nftnl_obj_snprintf_dflt(char *buf, size_t size, SNPRINTF_BUFFER_SIZE(ret, remain, offset); if (obj->ops) { - ret = obj->ops->snprintf(buf + offset, offset, type, flags, + ret = obj->ops->snprintf(buf + offset, remain, type, flags, obj); SNPRINTF_BUFFER_SIZE(ret, remain, offset); } - ret = snprintf(buf + offset, offset, "]"); + ret = snprintf(buf + offset, remain, "]"); SNPRINTF_BUFFER_SIZE(ret, remain, offset); return offset; -- 2.30.1