From: Phil Sutter <phil@nwl.cc>
Date: Thu, 7 Mar 2024 12:56:14 +0000 (+0100)
Subject: obj: Enforce attr_policy compliance in nftnl_obj_set_data()
X-Git-Tag: libnftnl-1.2.7~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5d94baba0f43426120ce025aacaa74406659ad7f;p=thirdparty%2Flibnftnl.git

obj: Enforce attr_policy compliance in nftnl_obj_set_data()

Every object type defines an attr_policy array, so deny setting
attributes for object types which don't have it present or if it
specifies a non-zero maxlen which is lower than the given data_len.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---

diff --git a/src/object.c b/src/object.c
index bd4e51a2..2ddaa29c 100644
--- a/src/object.c
+++ b/src/object.c
@@ -151,7 +151,12 @@ int nftnl_obj_set_data(struct nftnl_obj *obj, uint16_t attr,
 	default:
 		if (!obj->ops ||
 		    attr < NFTNL_OBJ_BASE ||
-		    attr > obj->ops->nftnl_max_attr)
+		    attr > obj->ops->nftnl_max_attr ||
+		    !obj->ops->attr_policy)
+			return -1;
+
+		if (obj->ops->attr_policy[attr].maxlen &&
+		    obj->ops->attr_policy[attr].maxlen < data_len)
 			return -1;
 
 		if (obj->ops->set(obj, attr, data, data_len) < 0)