Re: [PATCH libmnl 4/5] nlmsg: do not read past nlmsg_len in mnl_nlmsg_fprintf()

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Nov 06, 2026 at 08:18:39PM +0100, Florian Stosse wrote:
> mnl_nlmsg_fprintf_payload() prints the message in 4-byte words while
> i < nlmsg_len. mnl_nlmsg_ok() does not require nlmsg_len to be a
> multiple of 4, so for an unaligned length the last word reads up to 3
> bytes past the end of the message, and past the buffer when it ends
> there.

This function is used for debugging, I think it can be confusing if it
skips them.

It should at least print that it is leaving bytes behind while
printing.

> Only print complete words within nlmsg_len.
> 
> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
> Signed-off-by: Florian Stosse <florian.stosse@harvester.fr>
> ---
>  src/nlmsg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/nlmsg.c b/src/nlmsg.c
> index f8eed79..e38f806 100644
> --- a/src/nlmsg.c
> +++ b/src/nlmsg.c
> @@ -302,7 +302,7 @@ static void mnl_nlmsg_fprintf_payload(FILE *fd, const struct nlmsghdr *nlh,
>  	if (fdnum != -1)
>  		colorize = isatty(fdnum);
>  
> -	for (i=sizeof(struct nlmsghdr); i<nlh->nlmsg_len; i+=4) {
> +	for (i=sizeof(struct nlmsghdr); i + 4 <= nlh->nlmsg_len; i+=4) {
>  		char *b = (char *) nlh;
>  		struct nlattr *attr = (struct nlattr *) (b+i);
>  
> -- 
> 2.56.0.windows.4
>