From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 12 Jan 2024 11:33:38 +0000 (+0100)
Subject: set_elem: use nftnl_data_cpy() in NFTNL_SET_ELEM_{KEY,KEY_END,DATA}
X-Git-Tag: libnftnl-1.2.7~32
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=974af82c0bb0bc5958ccd759bd3a0f2bddbc8d83;p=thirdparty%2Flibnftnl.git

set_elem: use nftnl_data_cpy() in NFTNL_SET_ELEM_{KEY,KEY_END,DATA}

Use safe nftnl_data_cpy() to copy key into union nftnl_data_reg.

Follow up for commit:

bc2afbde9eae ("expr: fix buffer overflows in data value setters")

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/src/set_elem.c b/src/set_elem.c
index 884faff4..9207a0db 100644
--- a/src/set_elem.c
+++ b/src/set_elem.c
@@ -126,12 +126,12 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr,
 		memcpy(&s->set_elem_flags, data, sizeof(s->set_elem_flags));
 		break;
 	case NFTNL_SET_ELEM_KEY:	/* NFTA_SET_ELEM_KEY */
-		memcpy(&s->key.val, data, data_len);
-		s->key.len = data_len;
+		if (nftnl_data_cpy(&s->key, data, data_len) < 0)
+			return -1;
 		break;
 	case NFTNL_SET_ELEM_KEY_END:	/* NFTA_SET_ELEM_KEY_END */
-		memcpy(&s->key_end.val, data, data_len);
-		s->key_end.len = data_len;
+		if (nftnl_data_cpy(&s->key_end, data, data_len) < 0)
+			return -1;
 		break;
 	case NFTNL_SET_ELEM_VERDICT:	/* NFTA_SET_ELEM_DATA */
 		memcpy(&s->data.verdict, data, sizeof(s->data.verdict));
@@ -145,8 +145,8 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr,
 			return -1;
 		break;
 	case NFTNL_SET_ELEM_DATA:	/* NFTA_SET_ELEM_DATA */
-		memcpy(s->data.val, data, data_len);
-		s->data.len = data_len;
+		if (nftnl_data_cpy(&s->data, data, data_len) < 0)
+			return -1;
 		break;
 	case NFTNL_SET_ELEM_TIMEOUT:	/* NFTA_SET_ELEM_TIMEOUT */
 		memcpy(&s->timeout, data, sizeof(s->timeout));