expr: missing offset handling for snprintf() in hash and numgen

Fix incorrect output when offset attribute is unset.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/expr/hash.c b/src/expr/hash.c
index c235502870e6f70b90402fe48cd33e74a314083a..83f93179c26dae7a0775213db825b0499439ebd5 100644 (file)
--- a/src/expr/hash.c
+++ b/src/expr/hash.c
@@ -220,7 +220,7 @@ nftnl_expr_hash_snprintf_default(char *buf, size_t size,
        SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
        if (hash->offset) {
-               ret = snprintf(buf, len, "offset %u ", hash->offset);
+               ret = snprintf(buf + offset, len, "offset %u ", hash->offset);
                SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
        }
 

diff --git a/src/expr/numgen.c b/src/expr/numgen.c
index e4e055e347a324667c003f714205520a075dd215..a15f03ae834b68cc79bf31afe95e52bb02e1ec45 100644 (file)
--- a/src/expr/numgen.c
+++ b/src/expr/numgen.c
@@ -194,7 +194,7 @@ nftnl_expr_ng_snprintf_default(char *buf, size_t size,
        }
 
        if (ng->offset) {
-               ret = snprintf(buf, len, "offset %u ", ng->offset);
+               ret = snprintf(buf + offset, len, "offset %u ", ng->offset);
                SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
        }