Re: [PATCH libmnl 0/5] libmnl: fix memory safety issues found by static analysis

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Nov 06, 2026 at 08:18:35PM +0100, Florian Stosse wrote:
> Hi,
> 
> This series fixes five bugs found while analysing libmnl with Frama-C
> (Eva, WP and E-ACSL-instrumented fuzzing). Each one was then confirmed
> on current master with a small standalone program under ASan/UBSan.
> 
> None of them can be triggered by netlink data received from the kernel
> through the usual parsing path. They all need a caller that uses the
> API in a less common, but valid or near-valid, way, so I am sending
> them as ordinary fixes.
> 
> Patch 1 is the most relevant one. When the message that overflowed a
> batch is larger than the messages already in it, mnl_nlmsg_batch_reset()
> memcpy()s it onto an overlapping range and then reads nlmsg_len back
> from the overwritten location. With limit = 100, a 20-byte message
> followed by a 92-byte one leaves mnl_nlmsg_batch_size() returning
> 0x97969594 on glibc/x86-64, and the next mnl_nlmsg_batch_next() uses
> b->buf + 0x97969594.
> 
> Patches 2 and 3 fix out-of-bounds accesses on unusual input:
> - The *_check() builders compare the unaligned nlmsg_len against
>   buflen while the attribute is written at MNL_ALIGN(nlmsg_len), so
>   they can write up to 3 bytes past the buffer.
> - mnl_attr_get_payload_len() wraps for nla_len < 4, which makes
>   mnl_attr_parse_nested() read past the end of the nest.
> 
> Patches 4 and 5 are minor:
> - mnl_nlmsg_fprintf() can read up to 3 bytes past an unaligned message.
> - mnl_cb_error() can compute -INT_MIN.
> 
> I can send the reproducers if they are useful.

I'm planning to apply 1-3.

Patch 4 and 5, it would be good to display in some way that unaligned
bytes has been ignored while printing. As for the -INT_MIN case, it is
probably safe to remove the workaround in userspace, IIRC this was
helping with a very old kernel where netlink was reported a negative
errno value in the error message, it can possibly be removed and the
need for this ugly corner case will not be needed anymore.

I am looking into adding

#ifdef __GNUC__
#define unlikely(x) __builtin_expect(!!(x), 0)
#define likely(x)   __builtin_expect(!!(x), 1)
#endif

so this can be used in patch 3 in the check there.