Use the current remaining space in the buffer to ensure more userdata attributes still fit in, buf->size is the total size of the userdata buffer. Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> --- src/udata.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/udata.c b/src/udata.c index 0cc3520ccede..e9bfc35e624c 100644 --- a/src/udata.c +++ b/src/udata.c @@ -42,6 +42,11 @@ uint32_t nftnl_udata_buf_len(const struct nftnl_udata_buf *buf) return (uint32_t)(buf->end - buf->data); } +static uint32_t nftnl_udata_buf_space(const struct nftnl_udata_buf *buf) +{ + return buf->size - nftnl_udata_buf_len(buf); +} + EXPORT_SYMBOL(nftnl_udata_buf_data); void *nftnl_udata_buf_data(const struct nftnl_udata_buf *buf) { @@ -74,7 +79,8 @@ bool nftnl_udata_put(struct nftnl_udata_buf *buf, uint8_t type, uint32_t len, { struct nftnl_udata *attr; - if (len > UINT8_MAX || buf->size < len + sizeof(struct nftnl_udata)) + if (len > UINT8_MAX || + nftnl_udata_buf_space(buf) < len + sizeof(struct nftnl_udata)) return false; attr = (struct nftnl_udata *)buf->end; -- 2.30.2