diff options
author | Emmanuel Thierry <emmanuel.thierry@telecom-bretagne.eu> | 2013-04-24 16:39:19 (GMT) |
---|---|---|
committer | Thomas Graf <tgraf@suug.ch> | 2013-04-28 08:34:50 (GMT) |
commit | 979ea335b0141eb62682056be42ccb4b01e6e2a2 (patch) | |
tree | 4cca69f69d311883e3b405ec95de7a6a9f5d4bd3 | |
parent | 3a6d256da598d2fd9dc20137f208b88295374b67 (diff) | |
download | libnl-979ea335b0141eb62682056be42ccb4b01e6e2a2.zip libnl-979ea335b0141eb62682056be42ccb4b01e6e2a2.tar.gz libnl-979ea335b0141eb62682056be42ccb4b01e6e2a2.tar.bz2 |
Wrong calcultation in nla_reserve
There seams to be an error in the calculation of needed space for the message in nla_reserve. The current size of the message is counted twice: Once in NLMSG_ALIGN, once in the condition below.
This causes nla_put_* calls to be rejected if the allocation size of the message has been strictly calculated by the caller.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
-rw-r--r-- | lib/attr.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -464,7 +464,7 @@ struct nlattr *nla_reserve(struct nl_msg *msg, int attrtype, int attrlen) tlen = NLMSG_ALIGN(msg->nm_nlh->nlmsg_len) + nla_total_size(attrlen); - if ((tlen + msg->nm_nlh->nlmsg_len) > msg->nm_size) + if (tlen > msg->nm_size) return NULL; nla = (struct nlattr *) nlmsg_tail(msg->nm_nlh); |