From 5fbf4169fba1dfef0f461c4fe31bed70610ebce2 Mon Sep 17 00:00:00 2001

From: Phil Sutter <phil@nwl.cc>

Date: Fri, 11 Jun 2021 17:08:34 +0200

Subject: [PATCH] rule: Fix for potential off-by-one in cmd_add_loc()

Using num_attrs as index means it must be at max one less than the

array's size at function start.

Fixes: 27362a5bfa433 ("rule: larger number of error locations")

Signed-off-by: Phil Sutter <phil@nwl.cc>

(cherry picked from commit 2d0a7a9adeb30708d6fbbee57476c0d4b9214dbd)

Signed-off-by: Phil Sutter <psutter@redhat.com>

---

 src/rule.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rule.c b/src/rule.c

index e4bb6bae276a0..03422da3a7560 100644

--- a/src/rule.c

+++ b/src/rule.c

@@ -1491,7 +1491,7 @@ struct cmd *cmd_alloc(enum cmd_ops op, enum cmd_obj obj,

 void cmd_add_loc(struct cmd *cmd, uint16_t offset, const struct location *loc)

 {

-	if (cmd->num_attrs > NFT_NLATTR_LOC_MAX)

+	if (cmd->num_attrs >= NFT_NLATTR_LOC_MAX)

 		return;

 	cmd->attr[cmd->num_attrs].offset = offset;

-- 

2.31.1