a2ea441692
- Install an improved sample config - Fix permissions of osf-related configs - rule: Fix for potential off-by-one in cmd_add_loc() - netlink_delinearize: Fix suspicious calloc() call - netlink: Avoid memleak in error path of netlink_delinearize_obj() - netlink: Avoid memleak in error path of netlink_delinearize_table() - netlink: Avoid memleak in error path of netlink_delinearize_chain() - netlink: Avoid memleak in error path of netlink_delinearize_set() - json: Drop pointless assignment in exthdr_expr_json() - evaluate: Mark fall through case in str2hooknum() - parser_json: Fix for memleak in tcp option error path - parser_bison: Fix for implicit declaration of isalnum - main: fix nft --help output fallout from 719e4427 - tests: add icmp/6 test where dependency should be left alone - payload: check icmp dependency before removing previous icmp expression Resolves: rhbz#1933117, rhbz#1938823, rhbz#1931790, rhbz#1964987, rhbz#1971600
33 lines
1.0 KiB
Diff
33 lines
1.0 KiB
Diff
From 5fbf4169fba1dfef0f461c4fe31bed70610ebce2 Mon Sep 17 00:00:00 2001
|
|
From: Phil Sutter <phil@nwl.cc>
|
|
Date: Fri, 11 Jun 2021 17:08:34 +0200
|
|
Subject: [PATCH] rule: Fix for potential off-by-one in cmd_add_loc()
|
|
|
|
Using num_attrs as index means it must be at max one less than the
|
|
array's size at function start.
|
|
|
|
Fixes: 27362a5bfa433 ("rule: larger number of error locations")
|
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
(cherry picked from commit 2d0a7a9adeb30708d6fbbee57476c0d4b9214dbd)
|
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
---
|
|
src/rule.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/rule.c b/src/rule.c
|
|
index e4bb6bae276a0..03422da3a7560 100644
|
|
--- a/src/rule.c
|
|
+++ b/src/rule.c
|
|
@@ -1491,7 +1491,7 @@ struct cmd *cmd_alloc(enum cmd_ops op, enum cmd_obj obj,
|
|
|
|
void cmd_add_loc(struct cmd *cmd, uint16_t offset, const struct location *loc)
|
|
{
|
|
- if (cmd->num_attrs > NFT_NLATTR_LOC_MAX)
|
|
+ if (cmd->num_attrs >= NFT_NLATTR_LOC_MAX)
|
|
return;
|
|
|
|
cmd->attr[cmd->num_attrs].offset = offset;
|
|
--
|
|
2.31.1
|
|
|