From: Pengpeng Hou Ensure size is correct, otherwise bail out with EINVAL. Fixes: 239fbdb8979d ("tunnel: add support to geneve options") Signed-off-by: Pengpeng Hou Signed-off-by: Pablo Neira Ayuso --- src/obj/tunnel.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/obj/tunnel.c b/src/obj/tunnel.c index 08adeb50b107..4b302f66ecc5 100644 --- a/src/obj/tunnel.c +++ b/src/obj/tunnel.c @@ -866,9 +866,17 @@ static int nftnl_tunnel_opt_geneve_set(struct nftnl_tunnel_opt *opt, uint16_t ty { switch(type) { case NFTNL_TUNNEL_GENEVE_CLASS: + if (data_len != sizeof(uint16_t)) { + errno = EINVAL; + return -1; + } memcpy(&opt->geneve.geneve_class, data, data_len); break; case NFTNL_TUNNEL_GENEVE_TYPE: + if (data_len != sizeof(uint8_t)) { + errno = EINVAL; + return -1; + } memcpy(&opt->geneve.type, data, data_len); break; case NFTNL_TUNNEL_GENEVE_DATA: -- 2.47.3