When parsing NFTA_SET_DESC_CONCAT coming from the kernel, make sure provided list does not go over the boundary, resulting in an array overrun. This is hardening for correctness, kernel should not be sending a list larger than NFT_REG32_COUNT. Signed-off-by: Pablo Neira Ayuso --- src/set.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/set.c b/src/set.c index a017017e1fb6..6444de0affba 100644 --- a/src/set.c +++ b/src/set.c @@ -548,6 +548,9 @@ nftnl_set_desc_concat_field_parse_attr_cb(const struct nlattr *attr, void *data) if (mnl_attr_validate(attr, MNL_TYPE_U32)) return MNL_CB_ERROR; + if (s->desc.field_count >= NFT_REG32_COUNT) + return -1; + s->desc.field_len[s->desc.field_count] = ntohl(mnl_attr_get_u32(attr)); s->desc.field_count++; -- 2.47.3