From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Stosse <florian.stosse@harvester.fr>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH libmnl 1/5] nlmsg: fix overlapping copy in mnl_nlmsg_batch_reset()
Date: Tue, 10 Nov 2026 01:51:47 +0100 [thread overview]
Message-ID: <avJqoxKJEzgefDV-@chamomile> (raw)
In-Reply-To: <20261106191841.1645-2-florian.stosse@harvester.fr>
On Fri, Nov 06, 2026 at 08:18:36PM +0100, Florian Stosse wrote:
> When the message that overflowed the batch is longer than the messages
> already batched, the source (b->cur = b->buf + b->buflen) and destination
> (b->buf) of the copy overlap, which is undefined for memcpy(). Moreover,
> nlmsg_len is read again from the old location after the copy has
> overwritten it, so b->buflen and b->cur are set from message payload bytes
> and the next mnl_nlmsg_batch_next() dereferences a wild pointer.
>
> Read the length before moving the message and use memmove().
>
> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No, this can't be a Co-Author. Maybe this can use Assisted-by:
next prev parent reply other threads:[~2026-11-10 0:51 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-06 19:18 [PATCH libmnl 0/5] libmnl: fix memory safety issues found by static analysis Florian Stosse
2026-11-06 19:18 ` [PATCH libmnl 1/5] nlmsg: fix overlapping copy in mnl_nlmsg_batch_reset() Florian Stosse
2026-11-10 0:51 ` Pablo Neira Ayuso [this message]
2026-11-06 19:18 ` [PATCH libmnl 2/5] attr: account for alignment padding in the *_check() builders Florian Stosse
2026-11-06 19:18 ` [PATCH libmnl 3/5] attr: do not wrap mnl_attr_get_payload_len() for nla_len < 4 Florian Stosse
2026-11-06 19:18 ` [PATCH libmnl 4/5] nlmsg: do not read past nlmsg_len in mnl_nlmsg_fprintf() Florian Stosse
2026-11-13 10:46 ` Pablo Neira Ayuso
2026-11-06 19:18 ` [PATCH libmnl 5/5] callback: avoid signed overflow on INT_MIN error code Florian Stosse
2026-11-13 11:05 ` Pablo Neira Ayuso
2026-11-13 11:47 ` [PATCH libmnl 0/5] libmnl: fix memory safety issues found by static analysis Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=avJqoxKJEzgefDV-@chamomile \
--to=pablo@netfilter.org \
--cc=florian.stosse@harvester.fr \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.