From: Phil Sutter <phil@nwl.cc>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [libnftnl PATCH 1/3] set: Fix for array overrun when setting NFTNL_SET_DESC_CONCAT
Date: Wed, 4 Dec 2024 15:45:14 +0100 [thread overview]
Message-ID: <Z1Bq-oBCmBjRwOJC@orbyte.nwl.cc> (raw)
In-Reply-To: <Z1BnoHnLGem-1KFV@calendula>
On Wed, Dec 04, 2024 at 03:30:56PM +0100, Pablo Neira Ayuso wrote:
> Hi Phil,
>
> On Wed, Nov 27, 2024 at 07:01:01PM +0100, Phil Sutter wrote:
> > Assuming max data_len of 16 * 4B and no zero bytes in 'data':
> > The while loop will increment field_count, use it as index for the
> > field_len array and afterwards make sure it hasn't increased to
> > NFT_REG32_COUNT. Thus a value of NFT_REG32_COUNT - 1 (= 15) will pass
> > the check, get incremented to 16 and used as index to the 16 fields long
> > array.
> > Use a less fancy for-loop to avoid the increment vs. check problem.
>
> for-loop is indeed better.
>
> Patch LGTM, thanks.
>
> > Fixes: 407f616ea5318 ("set: buffer overflow in NFTNL_SET_DESC_CONCAT setter")
> > Signed-off-by: Phil Sutter <phil@nwl.cc>
>
> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Series applied, thanks!
prev parent reply other threads:[~2024-12-04 14:45 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-11-27 18:01 [libnftnl PATCH 1/3] set: Fix for array overrun when setting NFTNL_SET_DESC_CONCAT Phil Sutter
2024-11-27 18:01 ` [libnftnl PATCH 2/3] tests: Extend set test by NFTNL_SET_DESC_CONCAT Phil Sutter
2024-11-27 18:01 ` [libnftnl PATCH 3/3] tests: Fix for ASAN Phil Sutter
2024-12-04 14:30 ` [libnftnl PATCH 1/3] set: Fix for array overrun when setting NFTNL_SET_DESC_CONCAT Pablo Neira Ayuso
2024-12-04 14:45 ` Phil Sutter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z1Bq-oBCmBjRwOJC@orbyte.nwl.cc \
--to=phil@nwl.cc \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.