* [nft PATCH] mnl: Don't use nftnl_set_set()
@ 2019-10-15 14:17 Phil Sutter
2019-10-15 14:30 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Phil Sutter @ 2019-10-15 14:17 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
The function is unsafe to use as it effectively bypasses data length
checks. Instead use nftnl_set_set_str() which at least asserts a const
char pointer is passed.
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
src/mnl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/mnl.c b/src/mnl.c
index 14fa4a7186fd3..75ab07b045aa5 100644
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -945,7 +945,7 @@ mnl_nft_set_dump(struct netlink_ctx *ctx, int family, const char *table)
nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETSET, family,
NLM_F_DUMP, ctx->seqnum);
if (table != NULL)
- nftnl_set_set(s, NFTNL_SET_TABLE, table);
+ nftnl_set_set_str(s, NFTNL_SET_TABLE, table);
nftnl_set_nlmsg_build_payload(nlh, s);
nftnl_set_free(s);
--
2.23.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [nft PATCH] mnl: Don't use nftnl_set_set()
2019-10-15 14:17 [nft PATCH] mnl: Don't use nftnl_set_set() Phil Sutter
@ 2019-10-15 14:30 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2019-10-15 14:30 UTC (permalink / raw)
To: Phil Sutter; +Cc: netfilter-devel
On Tue, Oct 15, 2019 at 04:17:45PM +0200, Phil Sutter wrote:
> The function is unsafe to use as it effectively bypasses data length
> checks. Instead use nftnl_set_set_str() which at least asserts a const
> char pointer is passed.
>
> Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-10-15 14:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-15 14:17 [nft PATCH] mnl: Don't use nftnl_set_set() Phil Sutter
2019-10-15 14:30 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.