|
Lines 491-497
Link Here
|
| 491 |
int len = RTA_LENGTH(alen); |
491 |
int len = RTA_LENGTH(alen); |
| 492 |
struct rtattr *rta; |
492 |
struct rtattr *rta; |
| 493 |
|
493 |
|
| 494 |
if (NLMSG_ALIGN(n->nlmsg_len) + len > maxlen) { |
494 |
if (NLMSG_ALIGN(n->nlmsg_len) + RTA_ALIGN(len) > maxlen) { |
| 495 |
fprintf(stderr, "addattr_l ERROR: message exceeded bound of %d\n",maxlen); |
495 |
fprintf(stderr, "addattr_l ERROR: message exceeded bound of %d\n",maxlen); |
| 496 |
return -1; |
496 |
return -1; |
| 497 |
} |
497 |
} |
|
Lines 499-505
Link Here
|
| 499 |
rta->rta_type = type; |
499 |
rta->rta_type = type; |
| 500 |
rta->rta_len = len; |
500 |
rta->rta_len = len; |
| 501 |
memcpy(RTA_DATA(rta), data, alen); |
501 |
memcpy(RTA_DATA(rta), data, alen); |
| 502 |
n->nlmsg_len = NLMSG_ALIGN(n->nlmsg_len) + len; |
502 |
n->nlmsg_len = NLMSG_ALIGN(n->nlmsg_len) + RTA_ALIGN(len); |
| 503 |
return 0; |
503 |
return 0; |
| 504 |
} |
504 |
} |
| 505 |
|
505 |
|
|
Lines 539-545
Link Here
|
| 539 |
struct rtattr *subrta; |
539 |
struct rtattr *subrta; |
| 540 |
int len = RTA_LENGTH(alen); |
540 |
int len = RTA_LENGTH(alen); |
| 541 |
|
541 |
|
| 542 |
if (RTA_ALIGN(rta->rta_len) + len > maxlen) { |
542 |
if (RTA_ALIGN(rta->rta_len) + RTA_ALIGN(len) > maxlen) { |
| 543 |
fprintf(stderr,"rta_addattr_l: Error! max allowed bound %d exceeded\n",maxlen); |
543 |
fprintf(stderr,"rta_addattr_l: Error! max allowed bound %d exceeded\n",maxlen); |
| 544 |
return -1; |
544 |
return -1; |
| 545 |
} |
545 |
} |
|
Lines 547-553
Link Here
|
| 547 |
subrta->rta_type = type; |
547 |
subrta->rta_type = type; |
| 548 |
subrta->rta_len = len; |
548 |
subrta->rta_len = len; |
| 549 |
memcpy(RTA_DATA(subrta), data, alen); |
549 |
memcpy(RTA_DATA(subrta), data, alen); |
| 550 |
rta->rta_len = NLMSG_ALIGN(rta->rta_len) + len; |
550 |
rta->rta_len = NLMSG_ALIGN(rta->rta_len) + RTA_ALIGN(len); |
| 551 |
return 0; |
551 |
return 0; |
| 552 |
} |
552 |
} |
| 553 |
|
553 |
|
