[PATCH] Ensure check of nlmsg length is performed before actual access

From: maxdev@posteo.de
To: netdev@vger.kernel.org
Cc: BenBE@geshi.org, github@crpykng.de
Subject: [PATCH] Ensure check of nlmsg length is performed before actual access
Date: Wed, 30 Nov 2022 22:09:20 +0000	[thread overview]
Message-ID: <4fe84646-eef5-1a33-5451-11a7800c3c9d@posteo.de> (raw)

[-- Attachment #1: Type: text/plain, Size: 298 bytes --]

During a brief code review we noticed that the length field expected 
inside the payload of the message is accessed before it is ensured that 
the payload is large enough to actually hold this field.

The people mentioned in the commit message helped in the overall code 
review.

Kind regards,
Max

[-- Attachment #2: 0001-Ensure-check-of-nlmsg-length-is-performed-before-act.patch --]
[-- Type: text/x-patch, Size: 952 bytes --]

From 89216bacbc44d6719668132626ffd66862be6dfc Mon Sep 17 00:00:00 2001
From: Max Kunzelmann <maxdev@posteo.de>
Date: Wed, 23 Mar 2022 20:42:58 +0100
Subject: [PATCH] Ensure check of nlmsg length is performed before actual
 access

Reviewed-by: Benny Baumann <BenBE@geshi.org>
Reviewed-by: Robert Geislinger <github@crpykng.de>
---
 lib/libnetlink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/libnetlink.c b/lib/libnetlink.c
index 9af06232..0fe78943 100644
--- a/lib/libnetlink.c
+++ b/lib/libnetlink.c
@@ -732,13 +732,13 @@ int rtnl_dump_request_n(struct rtnl_handle *rth, struct nlmsghdr *n)
 static int rtnl_dump_done(struct nlmsghdr *h,
 			  const struct rtnl_dump_filter_arg *a)
 {
-	int len = *(int *)NLMSG_DATA(h);
-
 	if (h->nlmsg_len < NLMSG_LENGTH(sizeof(int))) {
 		fprintf(stderr, "DONE truncated\n");
 		return -1;
 	}
 
+	int len = *(int *)NLMSG_DATA(h);
+
 	if (len < 0) {
 		errno = -len;
 
-- 
2.38.1

