udata: incorrect userdata buffer size validation

Use the current remaining space in the buffer to ensure more userdata
attributes still fit in, buf->size is the total size of the userdata
buffer.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/udata.c b/src/udata.c
index 0cc3520ccede3185969b26fd7e36e7e7604aa104..e9bfc35e624c657c29b0f87cb64442c8a952f03e 100644 (file)
--- a/src/udata.c
+++ b/src/udata.c
@@ -42,6 +42,11 @@ uint32_t nftnl_udata_buf_len(const struct nftnl_udata_buf *buf)
        return (uint32_t)(buf->end - buf->data);
 }
 
+static uint32_t nftnl_udata_buf_space(const struct nftnl_udata_buf *buf)
+{
+       return buf->size - nftnl_udata_buf_len(buf);
+}
+
 EXPORT_SYMBOL(nftnl_udata_buf_data);
 void *nftnl_udata_buf_data(const struct nftnl_udata_buf *buf)
 {
@@ -74,7 +79,8 @@ bool nftnl_udata_put(struct nftnl_udata_buf *buf, uint8_t type, uint32_t len,
 {
        struct nftnl_udata *attr;
 
-       if (len > UINT8_MAX || buf->size < len + sizeof(struct nftnl_udata))
+       if (len > UINT8_MAX ||
+           nftnl_udata_buf_space(buf) < len + sizeof(struct nftnl_udata))
                return false;
 
        attr = (struct nftnl_udata *)buf->end;