From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 11 Jan 2024 00:13:37 +0000 (+0100)
Subject: set: buffer overflow in NFTNL_SET_DESC_CONCAT setter
X-Git-Tag: libnftnl-1.2.7~33
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=407f616ea53184ac3bfb9930d3f27ae1cff9c348;p=thirdparty%2Flibnftnl.git

set: buffer overflow in NFTNL_SET_DESC_CONCAT setter

Allow to set a maximum limit of sizeof(s->desc.field_len) which is 16
bytes, otherwise, bail out. Ensure s->desc.field_count does not go over
the array boundary.

Fixes: 7cd41b5387ac ("set: Add support for NFTA_SET_DESC_CONCAT attributes")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/src/set.c b/src/set.c
index 719e5961..b51ff9e0 100644
--- a/src/set.c
+++ b/src/set.c
@@ -194,8 +194,14 @@ int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data,
 		memcpy(&s->desc.size, data, sizeof(s->desc.size));
 		break;
 	case NFTNL_SET_DESC_CONCAT:
+		if (data_len > sizeof(s->desc.field_len))
+			return -1;
+
 		memcpy(&s->desc.field_len, data, data_len);
-		while (s->desc.field_len[++s->desc.field_count]);
+		while (s->desc.field_len[++s->desc.field_count]) {
+			if (s->desc.field_count >= NFT_REG32_COUNT)
+				break;
+		}
 		break;
 	case NFTNL_SET_TIMEOUT:
 		memcpy(&s->timeout, data, sizeof(s->timeout));