When the message that overflowed the batch is longer than the messages already batched, the source (b->cur = b->buf + b->buflen) and destination (b->buf) of the copy overlap, which is undefined for memcpy(). Moreover, nlmsg_len is read again from the old location after the copy has overwritten it, so b->buflen and b->cur are set from message payload bytes and the next mnl_nlmsg_batch_next() dereferences a wild pointer. Read the length before moving the message and use memmove(). Co-Authored-By: Claude Opus 5.5 Signed-off-by: Florian Stosse --- src/nlmsg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/nlmsg.c b/src/nlmsg.c index 30a7e63..f8eed79 100644 --- a/src/nlmsg.c +++ b/src/nlmsg.c @@ -531,8 +531,10 @@ EXPORT_SYMBOL void mnl_nlmsg_batch_reset(struct mnl_nlmsg_batch *b) { if (b->overflow) { struct nlmsghdr *nlh = b->cur; - memcpy(b->buf, b->cur, nlh->nlmsg_len); - b->buflen = nlh->nlmsg_len; + size_t len = nlh->nlmsg_len; + + memmove(b->buf, b->cur, len); + b->buflen = len; b->cur = b->buf + b->buflen; b->overflow = false; } else { -- 2.56.0.windows.4